Controlled Pod Into Terrain episode 7: AF 447

subtitled "We've Tried Nothing, And We're All Out Of Ideas."

this one features three very confused French men and a plane that was trying to tell them what to do, and they were ignoring it.

featuring, as always, the CPIT crew:

J, who is some kind of engineer, Kyra, who writes about plane crashes, and Ariadne, who knows about aviation business.

and for the first time ever, a special guest, Fox2Mike28!

Episode Transcript

(00:00):
Hello, and welcome to Controlled Pod Interterrain.

(00:03):
We are a multimedia podcast about air and space mishaps, aiming to put them in the broader
context of how and why things went wrong.
Now, to introduce myself and my co-hosts, my name is Ariadne.
I'm the business aviation industry experts.
And my pronouns are they and them.
My name's J.
I'm the systems and engineering expert.
My pronouns are they and them.
And my name is Kyra Dempsey, better known as the aviation writer Admiral Cloudberg.

(00:25):
And my pronouns are she and her.
And for the first time ever on Seapit, we have a guest.
Guest, would you like to introduce yourself to the group?
Thanks, Ari.
Hey, everybody.
You can call me Fox.
Pronouns he, him.
And I'm a captain on the Airbus A320 for one of the major US airlines.
I'm also an FAA Gold Seal certified flight instructor for single engine, multi engine,
and instrument ratings.
Well, welcome to the show.
Welcome to Seapit.

(00:45):
Thank you.
Yes, glad to have you.
Thank you.
Next slide.
Today, we're here to talk about this.
This used to be an A330, a French one.
I mean, I know they're mostly French, but this one was extra French.
But first, we have to do some kind of news thing.
Next slide.
And boy, do we have a lot of news, but we're going to focus on the two biggest stories

(01:07):
since we last spoke to you in December.
Next slide.
Okay.
Yes.
Tokyo Haneda Airport runway collision.
Go.
Yeah, this is I think we're looking at some very voided warranties here.
So here's what we know about this incident so far.
Obviously, this is based only on sort of open source information.
The preliminary reports on this will probably be out in the next few weeks.

(01:30):
A full report could be years, but we will obviously keep updating as we get more information.
So on January 2nd at 5 47 p.m. Tokyo time, a fully loaded A350 owned and operated by
Japan Airlines collided on the runway with a de Havilland DHC8 of the Japanese Coast
Guard.
The DHC8, for those that aren't familiar, is a mid-size regional turboprop.

(01:52):
The A350 is the largest Airbus in production.
It's very much the flagship for both Airbus and for a lot of airlines.
It is the most advanced jetliner ever made.
It may be among the most complex items currently in existence.
The 350 was operating in a maximum occupancy configuration with 379 people.
It was coming from Sapporo, which is sort of one of the northern islands in the Japanese

(02:14):
archipelago.
The Dash 8 was originating there in Haneda, and it was carrying relief supplies to the
Niigata Prefecture, which was on the west side of the Honshu Island that had received
a massive 7.6 earthquake the day before.
The Dash 8 was sitting on the taxiway.
It received a taxi and hold short order from the tower.

(02:36):
And in what we imagine was just an exhaustion into his state, the captain thought that he
had permission to taxi onto the runway, not to take off.
So he just sat there a thousand feet or so in front of the numbers.
Obviously this was sort of an understandable mistake.
These pilots were very likely flying back to back to back missions.
So he was parked right in front of the double white lines, if you're familiar with sort

(02:58):
of a runway in your mind, that is right in the middle of a touchdown target.
And the 350 came behind it and slammed it at about 150, 160 knots.
Our chief graphic designer, Jai, they created the diagrams we've got on screen here, which
show where the 350 would have impacted the Dash 8.

(03:19):
This was confirmed by the position of sort of the deformation on the engine, that's
where the impact was.
You can see the pictures of this to the right of the slide that we have here.
The Dash 8 looks tiny compared to the A350.
It really had no chance not being hit from behind by a 180 mile an hour wide body.

(03:44):
Super jumbo.
Super jumbo, yeah.
So regarding what was, there's some kind of miscommunication that occurred here obviously.
And so the actual language that was used in the clearance to the Dash 8 was quote, number
one taxi to holding point Charlie 5.
And we don't really know what happened, but it's possible this message somehow came across

(04:05):
like quote, your number one for departure on 34 left, taxi into position at hold via
Charlie 5, which would be permission to enter the runway, but that wasn't what was said.
But you can maybe imagine that the pilots are really tired.
They're aware of the criticality of their mission.
Again, this is a severe earthquake that killed over 200 people.
So they're listening to communications in English, which is not their native language.

(04:28):
And it isn't necessarily something they're speaking a lot as a Coast Guard crew that
presumably doesn't fly internationally.
But somehow both pilots came away with the same wrong answer.
And certainly at this time, there's no evidence that the first officer protested the captain's
stated belief that they could enter the runway.
But obviously the captain is the only one here who is alive to report that.

(04:50):
So there were also other potentially contributing factors to this collision, including inoperative
stop bar lights.
Those had been no tamed out since December 27th, I think.
And there was allegedly a collision warning in the control tower that the controllers
somehow did not notice.
Allegedly it did not have an aural component, only visual.
But once this was, this will all be clarified in the final report, which I will write an

(05:13):
article about when it comes out.
Anyway, if we return to the accident sequence here, the A350 is coming into land and it's
way harder than you think to see a dash eight on the runway at night.
And as far as we know, none of the pilots saw it until a split second before the collision,
if they saw it at all.
So one thing I do kind of want to circle back on, and Fox, this is where I'd love your opinion.

(05:37):
How common is it to get no tams for things like inoperative runway hold short lights
or taxi lights?
These are safety critical systems.
And I've heard that you can get a deluge of no tams and things can kind of get lost.
Can you kind of walk us through what it would be like?
How often is this?
Is this something that you and the first officer are going to specifically discuss as part

(06:01):
of the pre-flight brief?
Yes.
It is very common.
Well, I should say it's required, at least in the FAA, if something's out of service,
you know, approach lights, runway and identifier lights, hold short stop bar lights, and those
aren't in the no tams, something's gone desperately wrong.
And it is required, it is an SOP for both crew members to familiarize themselves with

(06:22):
the no tams.
But you're absolutely right.
There's a lot of them.
Like the tower no tams in particular are the ones that tend to be just dot, dot, dot, dot,
dot, dot, dot, all the same.
But any any good crew is both going to familiarize themselves with the key domes, particularly
those affecting approaches and one ways and taxiways.

(06:42):
Cool.
Thank you.
So the 350 probably weighed somewhere between 300,000 or 400,000 pounds on landing.
It was going about 150 knots, about 180 miles an hour.
It landed just behind the dash eight and slammed into it.
And it hit it with an absolutely staggering amount of energy.
I did some napkin math and pegged it at more than 500 megajoules, which is, you know, on

(07:08):
the same order as maybe 120 kilos of TNT.
It's the kind of energy that you would use to level a small building or more to the point
to completely destroy a small regional airliner.
It completely obliterated the dash eight.
Took a lot of it down the runway with it.
Yeah, so in this collision killed, we think probably instantly five of the six people

(07:34):
on board the dash eight.
But the captain somehow survived and was taken to hospital in critical condition.
And it seems he is presumably recovering or has recovered because he has made various
statements.
Yeah.
Not directly to the media, but he is reportedly.
One thing we don't know right now is what the state of any of the data recorders are.
Obviously, you know, this was a very hot, very intense fire, but these black boxes are

(07:58):
designed to withstand something like that.
So we have we know they were they were looking for them.
I believe they had found maybe one or two of the ones in the Airbus.
But they have they have found them all.
OK.
Or they did within a week or so, I think.
OK.
Do we have any any sort of what the status is on those if they've been able to read
them?
I haven't seen anything.
Probably we'll learn more about that in the preliminary report.

(08:20):
OK.
So they went to the airport at 850 after impact.
We want to stress there was no way for them to see or avoid the dash 8.
They went another full kilometer on quite a lot of fire.
Once the plane stopped, they kicked off the evacuation pretty much instantly.
It went as well as I would say could be imagined.
These guys got all 379 people off without any serious injury.

(08:42):
Credit goes obviously first to the cabin crew for handling a plane being very, very on fire
like champs.
And then it also goes to the passengers who apparently did exactly as they were told,
didn't get trapped, didn't try and bring suitcases with them.
And they all got off pretty much safely.
There were a few minor injuries during the evacuation.

(09:03):
But yeah, I think we had some twisted ankles on the slides.
That's usually pretty common.
Yeah.
Yeah.
So we should also note that this entire evacuation was done with the right engine still running,
which is something that's going to be investigated.
But it's possible the pilots couldn't shut it down due to multiple failures.
We don't really know yet.
Although it's not clear if the whole engine was running or just the core.

(09:23):
A lot of the stuff that's supposed to shut the engine down if it's damaged actually exists
inside the avionics bay, which, well, let's just say it had a lot of landing gear inside
it by this point.
And also probably quite a bit of dash eight inside it.
So you know, the FADEC was not at that point functioning correctly and couldn't be trusted

(09:46):
to shut the thing down.
And these engines are, of course, very much designed to keep running unless they're deliberately
shut down because, you know, an engine you can't shut down is better than one that shuts
itself down and can't be restart.
Yeah.
It leaves you with a giant airliner with no working engines.
That's kind of a bad situation.
So they really do design them to keep running unless they're told to shut down.

(10:12):
And it looks like they couldn't shut it down.
But it's not clear whether the third spool, which is the spool that runs the fan and has
the free power turbine on the back of it, was actually rotating because the engine nacelles
were quite badly sort of deformed and had ingested quite a lot of DHC8.

(10:36):
And so it's not clear that that was actually turning.
You know, a Trent XWB97 at 70% N1, which is about where you would be at landing, is a
terrifying thing to be around.
But one where the fan's not turning isn't quite as scary.
So you know, that probably helped them with the evacuation.
Yeah.

(10:57):
The fan, obviously, is massive on these, right?
So the Trent XWB is, I believe until the Ultrafan, which is the sort of next generation, hits
the market, this is the largest engine by diameter that's ever been fielded on a commercial
aircraft.
It's a huge bypass ratio.
It's more than three meters across.

(11:18):
Yeah, it's, you know, quite famously, you could fit an A320 inside the nacelle.
And it's 70% N1.
If it has the fan, it's pulling at about 1800 kilograms of air per second.
We don't know exactly how long the evacuation took.
The reports say that from IMPACT to the first responders certifying that everyone's off
the plane was about 18 minutes.

(11:40):
The actual evacuation seems to have started about six minutes after IMPACT, once the crew,
in coordination with first responders, had assessed their ability to evacuate safely.
Everyone was out within a couple of minutes.
The fire crews and the captain stayed on board to verify that the passengers made it off.
And Fox, here's where I want your input again, is there was a noticeable delay between the

(12:01):
time the aircraft came to a complete stop and the time that the captain ordered the
slides be deployed.
Can you walk us through sort of very briefly, what is the training, right?
So what, how are you trained to evaluate an emergency and to determine, do I pop the slides
immediately?
Is it better to wait for fire crews to get here?
You know, kind of briefly walk us through that, that internal discussion.
Oh, sure.

(12:21):
And we do rehearse that in our recurrent training when we're doing our V1 cuts where, and our
abort at takeoffs where we're going down the runway, the engine suddenly blows out.
We have to bring the plane safely to a stop.
We were deliberately taught not to reactively command an evacuation.
We're taught to look things over, complete all our checklist, all the E cams.

(12:41):
Again, I'm speaking for the Airbus, all our checklist and take our time to talk with air
traffic control, which would patch us through to ARF, the airport fire and rescue and say,
hey, how does the plane look?
Is one of the engines on fire?
Are the wheels on fire?
Do you see anything else that would bring evacuation?
Immediately assess things so we don't go off half-cocked.

(13:02):
You know, there have been incidents where that's been done, where people, where pilots
commanded evacuation and the flight attendants didn't, and also the flight attendants have
to do an assessment too.
Some airlines require all the windows to be open for both takeoff and landing.
That's because if you do have to do an abort at takeoff or emergency landing, they've got
to be able to see outside to see, hey, is there fire coming from an engine?

(13:24):
Because that can tell them, hey, let's not evacuate on this side because we've got a
burning possibly running engine on this side.
So we're encouraged to take our time to not rush the process of assessing the situation.
Again, crew resource management, getting outside help from air traffic control, from fire and
rescue, from the flight attendants, all the resources we have at hand so we can make the
most informed evacuation decision we can.

(13:46):
Okay, cool.
Yeah.
And I think just if you're thinking about, you know, how can you wait so long when the
airplane is on fire?
This accident was really a tribute to the construction of these fourth generation wide
bodies.
Like we said, this plane was on fire for it took 18 minutes before the captain was able
to certify that all the passengers were off the aircraft.

(14:06):
That is an eternity.
It's an incredible tribute to the construction of the A350.
It was able to be survivable by humans for almost an entire episode of Bob's Burgers.
Probably longer, actually.
Probably longer.
Yeah, you could start the episode and then finish it and then walk off the plane.
Yeah, and my understanding is, allegedly, you have big uncertainty on that, was that

(14:30):
several passengers were sort of frozen in terror and had to be coaxed off one by one,
which is why it took so long.
But also, I should note that when ARI says survivable by humans, that is an important
distinction because there were two under-reported casualties in the A350, specifically a dog
and a cat carried in the cargo hold, neither of which survived.
That's obviously very sad.

(14:51):
That's why my cat is getting a seat if we ever fly with her.
Yeah, Minpins in the lap.
It's just sort of an incidental note that in this accident, all the humans survived
and the animals in the cargo hold died.
In our last incident, almost all of the humans died and an animal in the cargo hold survived

(15:14):
without a scratch.
Yeah, true.
So, the 350 itself, obviously, as well as the Dash 8 very much, of course, were completely
destroyed.
This was the first ever hull loss of the 350.
There have been a couple of photos released of the wreckage and it's just nothing.
The three of us were speaking to a crash investigator about this.

(15:36):
They told me that for this kind of wreckage, one might be expected to sift through it with
a rake.
It is that far gone.
I've also seen some corners of the internet blame the fire on the 350's composite carbon
fibre construction.
Let me just say absolutely, unequivocally, that these people are wrong.
They are drawing the wrong conclusions and you should not trust anything they have to

(15:59):
say on any subject, least of all material physics.
The graphite mixture in that carbon fibre skin is specifically formulated for its high
temperature capabilities.
This thing sat in a pool of burning jet A for 20 minutes after rear-ending an entire
other airliner at 180 miles an hour and nobody on board the 350 was even injured in the crash.

(16:25):
Not even the people in the cockpit who were sitting right at the front of the thing.
Nobody was injured in the crash who was inside that 350 hull.
All of this is of course ignoring the fact that the aluminium skin on older designs of
aircraft actually will burn and actually melts and sags at less than 700 degrees C.

(16:51):
Moreover, we have fire test figures from the carbon fibre that is used in the 350 and it
doesn't go floppy and it doesn't perforate until you exceed 1000 degrees C because it
is mostly made of this graphite fibre and epoxy and they're incredibly refractory materials

(17:14):
compared to pretty much any light alloy that you would want to build a plane out of.
Unless you're building it out of titanium, which you're not.
BLEYNES- It's Kelly Johnson.
LUCIE Right, exactly.
You're not doing that and it would be outrageously expensive to do that for an airliner.
Unless you're actually doing something exotic like that, this is the best heat resistant

(17:39):
material you're going to find to build a plane out of and I am extremely glad that
after this people are going to be building a lot more planes out of it because it has
demonstrated that it is superior to the old material.
BLEYNES- Yeah.
I'm sure all 379 people on board appreciated those 300 extra Cs.

(18:01):
Anyway, the details of how the fire unfolded will be revealed in the final report, but
at this stage there's certainly no indication that the airplane performed anything other
than admirably for the record.
So let's move to our second news story.
Next slide.
Alaska Airlines Flight 1282.

(18:23):
LUCIE Okay, so where to start?
On January 5th, Alaska Air Flight 1282 from Portland, Oregon to Ontario, California was
at about 14,000 feet, six minutes after takeoff, when the aft left side door plug blew open.
BLEYNES- And this resulted in two empty seats being seriously damaged and a bunch of cellphones

(18:45):
falling a really long way without their screens breaking somehow.
and one kid's shirt being torn off.
We don't know at this time whether Yakety Sachs started playing over the PA.
It may have done.
BLEYNES- I'm just going to assume yes.
BLEYNES- Yes.
Yeah.
They were flying a 737 Max 9, which was around two months old at the time of the accident.

(19:06):
Now this was a door plug and not a door.
The difference between the two is that a door plug goes where an emergency exit is cut out
of the body, but because of the number of seats is not required.
So they put a door without any sort of arming mechanism or slide in, and then they just
put the inner wall over the top of it.
You know, in order to keep it from blowing open in flight and landing in, I don't know,

(19:30):
some lady's backyard in Oregon, they have four bolts that go into the hinging mechanisms
to keep it from opening up and out, which is the way it would if it was a door and needed
to be removed in an accident.
These bolts seem to have either been shaken loose or what's looking increasingly likely,
they were just totally missing.

(19:50):
In fact, this same plane had three warnings in the days and weeks before the accident
for pressurization leaks, likely from this door starting to kind of loosen.
And rather than check it, Alaska in their infinite wisdom decided to just keep doing
overland flights with it.
And actually, that's just how this works is, you know, the first thing that you check when
there's a pressurization issue is the pressurization controller.

(20:13):
And then if that doesn't work, you escalate up the troubleshooting list.
And they had not gotten to check all of the door seals yet.
That was farther down the list.
They never got there.
So I don't think there's any evidence that this plane is being improperly maintained.
Because this, of course, was a door plug, to actually inspect that door seal, they'd

(20:34):
have to rip the inside wall.
Right.
You know, it's not like an actual door where you could just open it and look at the gasket.
It would have involved them taking the plane out of service for, you know, at least a few
hours so they could remove that wall and actually inspect it.
Of course, if they'd actually done that, they might have noticed that these fasteners were

(20:57):
either loose or missing.
But they didn't.
And so we have this new story where the 737 MAX is yet again broken.
Yeah, and we could get down an extensive rabbit hole on a lot of the recent reporting about
how these bolts ended up missing, and the way that the door was designed and so on.

(21:18):
But we're going to save most of that for the NTSB.
And we're going to focus on the circumstances and consequences of this incident, which again
led to all 737 MAX 9s with door plugs, which is not all of them, but it's many of them,
getting grounded.
And as of writing the script, most of them are still on the ground, to my knowledge.
Yeah, I think so.
I think they might be returning some to service.

(21:40):
Now, something that is important to note here is that while this did happen on a 737 MAX,
it did not happen because this was a 737 MAX.
This is not a 737 specific issue.
The A320 family also uses these.
There was nothing inherent to the MAX or the 737 that caused this accident to happen.

(22:01):
Sort of.
Yeah, in fact, the Boeing 737-900ER, which is the equivalent model from the previous
generation, also uses mid-cabin door plugs.
And the FAA actually just recently recommended that airlines check those too.
So this is a process issue, not a design issue.
Fox, what would be the procedure, right?
So one thing I don't...

(22:21):
We've heard a lot of accounts from inside the cabin, but obviously with the...
I think the CVR got recorded over.
Is that correct?
So we will never actually know what happened in the cockpit.
So Fox, my understanding was that the CVR tape got recorded over, so we'll never know
what happened inside the cockpit.
But can you walk us through what...
If this happened in your aircraft, obviously, because we said that this is not specific

(22:44):
to a Boeing design Airbus A320s that Fox flies, they do have these.
So if an incident like this happened, what would be your first, second, third things
that you would do?
Well, we would get a warning in the cockpit, an ECAM show up telling us off the top of
my head, it would say excessive cabin altitude, indicating that your pressurization has gone

(23:05):
way down.
And the equivalent cabin altitude, which is usually about 7,000 or 8,000 feet, it's pressurized
to be an equivalent of about 7,000 or 8,000 feet.
So that cabin altitude would start going up, indicating that your cabin altitude is getting
closer to your actual altitude, which is the indication that the air is running out.
You'd see that.
And the ECAM would have...

(23:25):
I don't know them off the top of my head, but they would have steps to follow in terms
of manipulating the pressurization controls.
We would no doubt initiate an emergency descent where we basically let HC know what we're
doing, turn the fast seat belts on, get the thrust levers to idle, dump the nose, open
up the speed brakes to maximum, and just get the plane down to 10,000 feet.
And obviously in the cabin, the mast would drop, and everyone would need to put on their

(23:49):
mast to all the passengers, and we'd get the plane down, and then probably divert.
Yeah, I think that's what they did.
In fact, almost definitely divert, I should say.
Yeah, I think they immediately went back to Portland.
Is that correct?
Yeah, they did.
Yeah, okay.
So what I mean by the fact that this was sort of not really the max's fault is that this
looks pretty firmly to land on the shoulders of Boeing themselves.

(24:10):
There's not really going to be a way for them to worm themselves out of this this time.
The short version of what happened comes from Whistleblower, whose statements were corroborated
by the Seattle Times.
Basically Boeing was forcing contractor Spirit Aero Systems to redo a bunch of shoddy work,
which required the removal of the door plug.
But because of reasons we don't really have time to get into today, this act was not recorded
in the official system, so no one from Boeing knew to check the bolts post-repair.

(24:35):
This doesn't absolve Spirit Aero Systems, which is an independent company that was spun
out of Boeing in their deepest faces of sort of the Jack Welch era when they were selling
the E to Samsung and they became Boeing.
Yeah.
Spirit Aero Systems makes a ton of components for a lot of planes, private jets.
They are a military contractor.

(24:55):
They make the fuselage for the A350 that we just praised.
They make those out of their facilities in Oklahoma and Europe.
This is their facility in Wichita.
The 737 is their bread and butter.
They make 70% of the aircraft.
I should point out that the way they do work for Airbus is not the same as the way that

(25:18):
they do work for Boeing.
Because remember that Airbus was originally a bunch of separate companies that all sort
of got merged together and none of them really trusted each other at the beginning.
So they all have these checks on checks on checks on balances that all link.

(25:38):
These things together into a sort of web of quality control that just doesn't exist inside
of Boeing.
Yeah.
Spirit Aero Systems Wichita used to be a Boeing factory until they sold it and then bought
back the work that that factory was doing because it was more capital efficient.

(25:59):
So it's really the Spirit 737 Max.
Boeing managed to turn themselves into their own subcontractor which is just kind of mind-blowing
when you think about it.
What an own goal.
What an own goal.
Yeah.
I think that I want to just kind of double-click on something that Jay said which is that Airbus
it's not a company.

(26:21):
It's 10 companies in a trench coat and each of those companies was 10 companies before.
So you have 30 or 40 of these aircraft makers throughout European history that get mashed
into this one company.
And even today they still kind of view themselves as separate companies whereas Boeing very
much has this iconic company identity and history that goes all the way back to the

(26:45):
biplane era.
Spirit did shitty work.
It seems like that is not in dispute but it was Boeing's responsibility to verify that
work and they didn't.
737 Max problems continue to pile up.
We just brainstorming came up with snowman holes, loose tail belts, anti-ice cowling

(27:05):
certification problems, rear pressure bulkhead problems, landing gear problems.
None of this is even related to the plane's random nosedive mode that Boeing decided to
keep secret from everyone.
My know it's to say Boeing it's all shit.
We could do an entire episode just listing the various disasters that Boeing has participated
and caused.
We don't have enough time.

(27:26):
Maybe that'll be a bonus episode.
Fundamentally apart from anything else this is obliterating the value of the 737.
And I don't just mean their little resale value I mean the sort of brand value.
See the 737 is not that great of a plane.
Outside of Seattle and some freak show cultists that all fly for Southwest pretty much everyone
agrees.
Off the record I'm pretty sure you could even get some people from Boeing to agree that

(27:49):
it's a technically inferior plane to the A320.
The A320 is more advanced, it's more comfortable for the passengers and the crew, it's easier
to fly.
The Boeing argument was always that the 737 was a little bit cheaper to buy and a lot
cheaper to operate and fly.
My contention is that when you buy a plane that has to spend half of its life on the
tarmac because the FAA has given it yet another mandatory grounding then suddenly it's not

(28:13):
that much cheaper.
Is it Boeing?
Is it?
And let's not forget that every time this happens there's a whole bunch of mandatory
screwing around because planes absolutely hate sitting still.
And if they sit still for any period of time longer than about a day there's going to be
work that has to be done to return them to service.

(28:35):
Yeah, Jay you're absolutely right, that's a really good point.
You can't just kind of tow these things to the side of the ramp and park them.
Tires get flat spots, steel starts to harden, fluids can gel.
Planes are meant to run and to fly.
Any prolonged length of sitting requires checks and services and the longer it sits the more
expensive these checks get.

(28:57):
Alaska has made statements that they're going to stick with the 737 because lessons are
for betas and losers.
Look, stick with the stupid airframe if you want but I've seen this film before, I didn't
like the ending last time.
Boeing has appointed a guy named Kirkland H. Donald to be an independent auditor.
My first thought was they're bringing him into pencil whip a report, no one's ever
going to read it, but the more I learn about him the more I'm not so sure.

(29:21):
This guy is a retired four star admiral.
He spent 37 years in the US Navy's submarine command.
He spent the last eight as head of the US Navy's nuclear program.
Very briefly the Navy has something called SubSafe which has been the model for institutional
safety overhaul.
It was implemented by a sort of weird hero of mine, a man named Hyman Rickover who implemented
this.

(29:41):
As a result the US Navy has never had a single criticality nuclear incident.
In part they do this by training their crews to the point of absolute neurosis but the
reality is what they do works.
This guy's going to tear everything Boeing has done down to the last bolt.
We will all be very interested to read the report he submits or let's be honest ends

(30:03):
up leaking to the Seattle Times.
We're going to cover this story like 516 in detail when the final report comes out.
Obviously the admiral will have an article for now to close this out.
I will say talking amongst ourselves we've noticed that this seems to kind of awaken
something at Washington.
The White House has now become directly involved and that's bad news for Boeing.

(30:23):
The administration has decided that Boeing is now a problem that needs to be fixed.
They've burnt all their goodwill.
They've turned pretty much all their friends in DC and Seattle into enemies.
It's not great for them right now.
I'd just like to interject that when I pointed out that Senator Cantwell is not happy about

(30:44):
this someone told me oh but Boeing isn't a Washington state company anymore.
We're not talking about Boeing the company which is now based in Virginia.
We're talking about Boeing commercial aircraft here and they are very much based in Everett
and Renton.
Yeah they are the number one employer in the state.

(31:05):
If you piss off that state senator who happens to be on the Senate transportation board you
are in absolutely massive amounts of trouble.
This is a senator who allegedly hand delivered the Casey 96 contract to Boeing on a platter

(31:26):
and they've turned her into an enemy and that is a very bad place to be.
One last thing is has Erie said that I would have an article on this incident.
I don't actually plan to write an article on this incident at any point but we will
talk about it more anyway.
And with that next slide.
Okay let's get into the no taps for this episode.

(31:47):
And let me just jump in because I think we only explained this like once a few months
ago.
No taps is noticed to all podcasters.
It's our corrections page.
Okay so I have a mere culper.
This is a clarification to the non-directional beacon thing.
So when I was reading the original design information about ILS from the 1940s because
yes ILS is really freaking old the language was a bit confusing.

(32:13):
The ILS lateral guidance beam which is now known as the localizer and the ILS outer marker
beacon which is now usually kind of not used but is known as the locator are both called
different things at several points in the original IEEE papers and documents.
They also talk about sharing an antenna array between a non-directional location function

(32:37):
and the localizer which makes things even more confusing.
And the reason that they wanted to do this is because it makes it less likely to interfere
with itself.
It was kind of confusing and I've been doing signal processing for the last 30 years so
I honestly don't know what they were getting at with that.

(32:59):
If I could chime in on this Jay in the old days many of the older locator outer markers
which defined the final approach fix of ILS approach is basically the point where your
gear down, your down to landing speed, your flaps are fully out, you're committed to landing
were actually co-located with NDBs but they weren't directly connected with the ILS signal

(33:20):
frequency any part of the ILS system.
They just basically helped the pilot know when he would or she or they would be crossing
the final approach fix and on the older aircraft you'd actually get a tone in the cockpit you
know boom boom boom boom is what it sounded like as well as a blue light lighting up and
flashing to let you know that you crossed it but again it wasn't connected with the

(33:42):
ILS it was just sort of a progress marker and some of them were co-located with NDBs
and some of them even had NDB approaches.
You could shoot approaches off the NDB separate from the ILS but now most of the loans are
deactivated and aren't have GPS waypoints in space these days.

(34:03):
Right so then when we were referring to the ILS localizer being an NDB we were mistaken
there's just one that used to or sometimes in some cases still is just really close to
it or almost co-located with it.
Our next correction is that we do say fuck sometimes as Mastodon said babies don't watch

(34:28):
this, take the seed outside.
And in plain English this podcast still wouldn't be for children even if we talked pretty.
We are talking about accidents and most of them many hundreds of people die in.
And finally as a matter of disclosure and being good citizens we wanted to tell you
since we are covering Airbus and shitting on Boeing that one of the hosts of this podcast

(34:51):
owns Airbus stock it was stock that they bought with their own money and is a result of their
opinions on Airbus and Boeing and not the cause of them.
It's me I'm the one who bought it yay.
Okay last one our Patreon we have a Patreon if you want to support the show and add my
cloud works work and an announcement we will be recording our first ever bonus episode

(35:12):
in the next week or two.
We are going to be doing an oops all news episode it will be exclusive to patrons at
the $5 and up G2 bottle user level.
Even at our entry level though you still get access to our discord where we hang out, ship
post, we talk about airplanes, space planes, pets.
If you like the vibe of these episodes join the discord this show is pretty much just

(35:33):
a recorded and polished extension of that.
That's patreon.com slash CPIT patreon.com slash CPIT.
We want to give a special shout out to our supporters at the $15 Airframe Warranty Voider
and our $25 fire tetrahedron level.
Thank you An Slem, Fred with a PH and two anonymous donors for their contribution.

(35:57):
And a reminder that at the fire tetrahedron level we do mean we will send you an actual
physical fire tetrahedron and unlike the one in episode 3 this one isn't just for triangles.
A beautiful contribution to the world from the UAE GCAA.
I can confirm that it is extremely real and I will mail it to you along with a 5x7 postcard

(36:18):
of our wonderful logo and a letter signed by the three of us.
And go read Kira's recent article from last week or a couple weeks ago about UPS 6.
It's a wonderful story, she tells it beautifully and she does a great job of honoring hero
of the show Matthew Bell.
Before we get started on our main story one last note from the three of us.

(36:40):
This crash sucks, it's brutal, it was tragic, there's not really much to laugh about.
And as a result this episode is going to be a little less shitposty than normal.
But it's an important story and it's one we've been wanting to tell basically from
the beginning.
So let's get going.
So what is today's episode even about?
Okay, today we are here to talk about a flight that started in Brazil.

(37:04):
So what is Brazil?
Next slide.
I'm pretty sure that's Terry Gilliam's Brazil.
Try again.
I think that's the famous political operative Donna Brazeal.
Next slide.
That I believe if my Monty Python recognizing trees from quite a long way away is a Brazil

(37:25):
nut tree.
That's close.
It is close.
But I don't think it's quite right.
One last try.
Ah, that looks like Brazil.
I'm pretty sure that's Rio de Janeiro, which is unfortunately the last dry land that any
of today's victims ever saw.
Yeah.
So next slide.
Okay, so what is an Air France?

(37:47):
It's an institution in European aviation.
It's one of the largest flag carriers on Earth.
It's one of the founding members of SkyTeam.
It stemmed from smashing five airlines together.
Since then it's somehow become even more cursed and complicated.
It was also one of two airlines to fly Jay's favorite plane, Concorde, unwrapped from New
York to DC.
I love you so much, Concorde.

(38:11):
We kind of only have a small 111 corner this episode.
It's like a 111-200 corner.
Since the last episode we did kind of zero in on why we're so obsessed with the 111.
It's not the worst airliner of all time.
It's not even probably the worst Britain produced, but it was made in the same factory as Concorde,

(38:36):
designed and engineered by the same people at the same time.
You knew better.
Okay, so Soviet stuff sucked, right?
Everybody knows that.
Everything they made it out of sucked.
The factories they made it in sucked.
Everything they made it with sucked.
They were clever, but they were bad.

(38:58):
Like, BAC clearly knew better, which makes this thoroughly terrible plane the funniest
possible one.
As we show on the slide, anyway, top left hand corner, BAC designed the intake for Concorde,
the incredibly sophisticated analog computer controlled intake that trapped a bunch of
shockwaves in the right place so that the engine would get maximum pressure recovery

(39:22):
and not surge.
And this worked flawlessly for decades.
They never even once had an inlet unstart on any Concorde.
Meanwhile, the 111 had problems getting off the runway.
Do you see?
It's one of those classic cases of...
I'm not sure what exactly, but of something.

(39:45):
This is my favorite daughter Concorde.
This is my adoptive daughter, 111.
Yeah.
See, the difference between us and while there's your problem is we put our tangents in the
script.
Yeah, exactly.
Anyway, Air France was the launch customer for A320.
They've been all in on fly-by-wire pretty much since day one.

(40:06):
As far as tech goes, Air France has always been proud of being at the forefront.
Much like Lufthansa, Air France likes to seek revenue outside of flying airplanes.
In one case, quite famously with software, Air France was the lead driver behind the
development of the Amadeus booking software that's very much around.
If you use something like Google Flights or Kayak, there's a good chance your booking
will go through Air France software.

(40:27):
It was a state-owned airline until 1999, right around the time that they moved to the Euro.
It went public in 2003.
It merged with KLM.
The state sold off all but about 20% of its shares.
It remains absolutely huge.
Its livery remains absolutely classic.
As a somewhat darker detail, travelers used to call Air France Air Chance because they

(40:50):
had so many crashes.
And in fact, Air France has to this day the second highest body count of any airline after
Aeroflot.
But that's not to say that modern Air France isn't actually quite safe.
A lot of those crashes were in the 50s and 60s, except for the one we're going to talk
about today, which was their last and their worst.
So if we can go to the next slide, please.

(41:13):
Let's learn about the Airbus A330.
Was ist das?
The A330 was, as its name suggests, created to be the larger sister to the A320, the small
or sister to the A340.
It was designed for medium and sort of long-ish haul flying, especially trans-oceanic, trans-Atlantic
flying.
In fact, after the 777, the 330 is the best-selling widebody working today.

(41:35):
I actually looked this up.
It's real freaking close.
1,582 A330s have been delivered and 1,723 777s have been delivered.
Delta owns the most.
They're sucking it up like Dyson because Ed Bastion believes that Boeing can choke
on its own foot.
We have proof.

(41:56):
Yes, we do have proof.
Went to Toulouse with a cat, or went to Hamburg with a suitcase full of cash after January
1st.
Airbus has a Neo version that burns less gas.
It's quieter.
It's got a bunch more composites in it.
It's pretty beloved by airlines.
Again, mostly Delta.
Guys, Delta truly hates Boeing.

(42:19):
Just 757 Boeing, to be precise, Airy, post 757 Boeing.
Anyone who's ever been to one of Delta's hubs know that they still love the shit out
of their 757s and as far as I know, plan to fly them as long as the Air Force flies their
beefety toots.
While they were sad to retire their MD80s, they just seem to hate post-MD murder Boeing,
like everyone else by now.

(42:39):
Delta dispatch holding onto a 40-year-old 757 like it's my precious.
So the A330 cockpit is about 85-ish percent the same as the A320 that Fox flies.
The controls, the instruments, mostly in the same places.
The few differences include a larger hydraulic system.
The flight control computers are arranged a little bit differently, but it has the same

(43:00):
fly-by-wire setup, flight control methodology.
That's actually why we asked him to be here today.
It's why we asked him to help on both the outline for this episode and to come on and
be a guest.
In fact, Airbus prides itself on how similar its planes are to each other.
They, for instance, they scale the cockpit parts linearly between aircraft.
So for instance, the front view out of any of their aircraft is exactly the same proportional,

(43:22):
whether you're in the smallest A318 or A380.
So if you know on any Airbus aircraft, if you position the runway in a certain place
on the glare shield, no matter what Airbus you are, it will always be the exact same
location.
It's really popular as a middle of the road widebody.
It can handle mid to low traffic international routes, long distance, high density domestic,

(43:42):
pretty much anything you can throw at it.
You can get it with a CF6, a Trent or a Pratt & Whitney JT9D, because if you want a big engine,
it's pretty much just going to be one of those.
That's right, folks.
You can, in fact, put a Trent on it.
Yay.
Between its first flight in 1992, the incident in today's episode, the only mishap it ever

(44:02):
had was on a test flight.
And that, interestingly, makes two Airbus widebodies whose first in-service accident
has been mentioned in this episode.
The subject of today's episode, Foxtrot Golf Zulu Charlie Papa, was delivered new to Air
France in April of 2005.
All right, next slide, please.
And just to sort of show you what we mean about the similarity in the cockpit architecture,
what we have on the left is 320, which is Fox's office, the left hand's captain seat.

(44:27):
On the right, we have an A380.
The foreheadist of all airplanes, it's an insult to God and to gravity.
I assume this all looks very familiar to you, Fox.
You bet.
The thing I'll say is that it's very much as comfortable as it looks.
And I've sat in 737 cockpits, too.
It's much more comfortable.
The electronically adjustable seat's very good, slides back and forth, tier liking.

(44:48):
The lumbar sport, it's like those in modern cars with those little wheel thingies on the
side, works very well.
The footrests are really nice.
The tray tail's very useful, especially during taxi for copying clearances and cough cough,
avoiding runway incursions.
I'm 6'3", so a cockpit designed for pilot cover is a godsend.
Very cool, very cool.
Okay, next slide.

(45:08):
Okay, so now I finally get to talk about fly-by-wire.
It's where the computer flies the plane and then the pilot flies the computer.
Okay, okay, that's a bit of an oversimplification of it, but yes.
Also Margaret Hamilton invented it, bottom right corner, hero of the show.
Actually, Jay, wasn't Concorde weirdly kind of semi fly-by-wire?

(45:33):
It wasn't semi fly-by-wire.
It was absolutely fly-by-wire.
It had analogue fly-by-wire.
Electrical signals were transmitted from sensors and the controls and the system would interpret
these electrical signals through an analogue computer, which was sort of hardwired to do
the kinds of computations that you needed to make a tailless, gigantic, supersonic,

(45:57):
delta wing plane like that actually stable.
Because Concorde was unstable enough in any kind of low speed regime of flight that it
pretty much required that it actually help out the pilot in this way.
But once they'd started actually working on it, it turned out to be really great because

(46:18):
they could have it continuously calculate the balance of the plane.
Because of course, Concorde didn't have a tail and it didn't have canards, so it controlled
its pitch trim by moving centre of gravity forwards and backwards using fuel pumps.
It had about a tonne and a half of what they called ballast fuel or trim fuel that it moved

(46:39):
backwards and forwards between a tank in the nose and a tank in the tail to actually make
the plane balance in the same way that you would do, you know, stabiliser trim.
Of course, if you don't have a stabiliser, you can't do that.
The first fly-by-wire aircraft was actually the Lunar Landing Research Vehicle, which

(47:01):
you can see up here on the upper right, which probably gives you a bit of a clue about what
fly-by-wire does.
It uses a computer to make an aircraft act differently to the way physics would make
it act.
It's usually to make it more controllable, safer and more efficient.
The LLRV, the B2 and the X-29 that we have on screen are proof that if you have enough

(47:23):
computing power and horsepower, you can make literally anything fly.
To expand on that point, the most important thing to know about fly-by-wire is that you
don't directly control the plane.
There's no direct connection between your control inputs, the movement of any aerodynamic
deflection surfaces, your engine throttle, any kind of other control mechanisms that

(47:44):
you might have, like the LLRV has, you know, a bunch of hydrogen peroxide rocket motors
attached to it.
Instead, what you do is you make a request to move the plane in a certain way and the
computer will interpret that request and pass the word along to the actuators that it actually
has to have that happen, which enables things like protections that we'll get to in a bit

(48:07):
and command logic that allows one action, like say going to Toga thrust, to automatically
enable other things like, say, stowing the speed brakes.
Hmm.
Yeah.
That's right.
Yeah.
One thing that you might have figured out by now is that fly-by-wire actually relies
completely on accurate data because the computers that run a fly-by-wire aircraft don't have

(48:31):
common sense.
The humans that design these systems compensate for this with redundancy, error checking design,
very clever software and trying to bake the experience of pilots into this software, but
it's not perfect and it's not idiot proof and I am looking at you, Michelle Aselin.

(48:52):
From a business perspective, fly-by-wire, specifically the way Airbus does it, makes
a lot of sense.
As we said earlier, they want to make all their planes feel similar so that the pilots
can move from one to another with minimal training.
To achieve this, like for instance, the role in a side stick doesn't command a certain
deflection.
What it commands is a roll rate.
Like in pitch, it commands a load factor, something like 1.05g rather than a direct

(49:17):
deflection of the surface.
This means in theory, a pilot could fly a smaller 318 one day, a bigger A330 the next
and they feel the same, they handle the same.
Going from one family to another only requires what's called difference training because
relevant systems and procedures are the same.
Difference training for a full retype can be as little as a week or two.
On the other hand, going from a 737 to a 777 is a completely different aircraft.

(49:41):
A new retype rating could take months.
That's disastrous from a business perspective because you're paying for a pilot who isn't
flying just to go through horrendously expensive training.
Plus, you have to cover the flights that she is no longer flying.
Just to add some clarity to what Ari said, the A318 and the A330, they don't quite fly
quite the same because obviously one is triple the size of the other.

(50:03):
Their performance envelopes are different, but it's really close enough.
In order to understand how FlightAware gets that information, and why not getting it means
you're anything from a little fucked to mega fucked, we're going to cover in a bit
how planes get their data.
Suffice it to say though, in the most extreme examples, like this B2 over here that is currently
looking like, you know, not good, doasty, even a momentary disruption in data will ruin

(50:29):
your entire goddamn day.
This plane, the B2, it did not know it was humid outside, within seconds of becoming
airborne, became the most expensive plane crash of all time.
The F-117 was the same way.
One of its designers once said that if it weren't for the careful design and careful
maintenance of its pedostatic probes and fly-by-wire system, it would have no idea how to keep
the pointy end of the plane into the wind.

(50:51):
Yeah, you can really spit in the face of physics if you make enough lightning sound, think
hard enough.
The B2 is an abomination and a front to nature, and the very instant it lost one parameter,
it became completely unrecoverable and tried to fall out of the sky, and of course, as
you can see here, succeeded.
Yeah, so these kinds of incidents are not the case for Airbus flights, we want to make

(51:14):
that very clear.
These are inherently stable.
They want to continue flying in straight level flight, and that's what fly-by-wire computers
are designed to do.
They're always designed to make an aircraft feel stable, be stable, and always try and
take it to straight level flight as needed.
And you just can't do that, and you can't make a plane feel the same as another very

(51:35):
different plane with hydraulic servos and pulleys.
It takes a computer, and while you've got the computer there anyway, you can make it
protect the plane in ways that direct controls can't.
Computers are a lot faster than humans, they can pay attention to a lot more variables
at once.
And moreover, a computer can operate 17, 20, 100 different controls at the exact same instant,

(52:05):
whereas a human only has two hands and two feet.
All right, next slide.
Okay, so we've talked about how important good data is to the plane.
We're going to talk real quick about how the planes get that data.
So remember last episode, we talked at length about how planes know where they are along
the 2D surface of the Earth.
This is the 3D.
We're going to tell you about the other aspect, which is this is how planes know how high
and fast they are.

(52:26):
For that, you're going to need something called a pitot tube.
We actually have included the pitot tube on the screen.
It's the one on the left.
And this one indicates that it feeds the first officer's data.
That's why it says FO.
On a very fundamental level, they work by comparing the air that is coming into them
at speed to the air from somewhere else in the plane that isn't directly facing the wind.

(52:47):
These probes measure that speed.
They calculate it into knots of indicated airspeed, but they also combine that information
with the altitude and the temperature to come up with its Mach number, which is how close
it is to the sort of Chuck Yeager wall in the sky speed of sound.
Yes, indeed.
And back when I was an instructor, I made sure that my student pilots knew this before
they ever sat in the cockpit of their first single engine piston trainer.
I mean, the knowledge about how the pitot statics just work is integral to understand

(53:11):
the dynamics of flying.
And it becomes even more important when you're learning how to fly on instruments.
I'd just like to interject.
Chuck's just said that these become even more important when you're learning how to fly
on instruments.
Well, the fly-by-wire computer is always flying on instruments.
You could think about it that way.
It doesn't see out of the front of the plane.

(53:33):
It is always flying on instruments.
That's a real good point.
Yeah.
Yeah.
The inner workings of these are very, very simple, right?
This has been a sort of solved technology going back pretty much to the very, very early
days of flight.
It's a tube that faces the same direction as the plane travels.
Air enters it and pushes on a diaphragm.
The faster you go, the harder the air press is on it.
You compare that to static pressure, which is gathered at one of a handful of small ports.

(53:58):
On the A330, the dynamic pressure is measured with a probe under the cockpit windows.
The static pressure is measured at a couple of places along the side of the body.
There are three pitot probes, one for each pilot and a third standby probe.
The static port, we've included, this one's on the right side of the slide.
And again, you notice that there are two.
There are always at least two of everything.

(54:18):
So as we said, it's absolutely vital that these probes get accurate information.
They measure dynamic air pressure and nothing else.
So they have drains for water, heaters for ice.
The pitot heat on a large aircraft like the 330 turns on automatically when the engines
turn.
Any form of impurities blocking the pitot static ports from water or ice, dirt to nesting

(54:39):
insects and spiders, is a major threat to the safe operation of the aircraft.
Like we said, especially if you're in instrument conditions or if you're a fly-by-wire aircraft,
you are always on instrument conditions.
In fact, it was a wasp nest in a pitot tube that caused the crash of Bergen Air 301 in
1996.
Next slide.
OK, so we've talked about fly-by-wire.
Let's talk about how at a very simple level, Airbus flight decks are different than Boeing

(55:02):
ones.
This particular one, this is an A330 classic CEO flight deck.
In simple terms, Boeing has conventional controls in which the yokes are connected usually by
cables to hydraulically boosted control surfaces.
They're also interconnected with each other.
Whatever one yoke does, that's what the other one does.

(55:23):
So the situational awareness in a Boeing cockpit for the controls of what they're doing is
getting better.
You have excellent situational awareness that your fellow pilot is hauling back on the controls
because your yoke will be pressing on your abdomen.
Even in the two fly-by-wire Boeing planes, the 787 and the 787, where the yoke is not
connected directly to the hydraulic systems, the columns are linked together and they add

(55:44):
in a force feedback system to replicate what a hydraulic actuator would feel.
The 737 MAX is, well, let's call it a partial fly-by-wire plane, but we'll get into that
at a later date, at which point I will be extremely sarcastic about what they did.
Yes, exactly.

(56:06):
OK, so in the Airbus cockpit, the side sticks on the rear end are not linked at all.
They have no form of force feedback.
They move independently.
Their inputs are algebraically summed, meaning that if you move both of them, the system
will try to average the two of them out.
So they can double each other's inputs when moved together.
They cancel each other out when they're moved opposite.

(56:26):
The side sticks do have a disconnect button, which disconnects the autopilot.
If it's held down, it cancels the input of the other side stick.
It also lets off an oral dual input warning.
And a little light will go on in front of the pilot.
It's going to let pilots know if both side sticks are being moved simultaneously, which
in normal operations should never happen.

(56:46):
Other than that, there is no visual or tactile reference for one pilot to know what the other
pilot is doing with their side stick during any sort of non-autopilot hand flying.
Specifically, the button to cancel out the other side stick's input is not so that you
can take over from another pilot.
It's specifically there in case one of the side sticks gets stuck.

(57:09):
That's the reason they fitted it.
Because of this, because there's no awareness of what the other one is doing, having a well
understood and practiced positive exchange of flight controls is extremely important,
not just to airlines, in all forms of dual pilot aviation.
It is one of the first things taught to new pilots getting their private license.
I have personally flown with Fox in a shitty little single engine Cethna around Seattle

(57:32):
that was almost a decade ago or over a decade ago now.
I can confirm for something as simple as tying his shoes while we were parked, he made sure
to establish your controls and my controls when he was done just so I could stand on
the brakes.
Hey, Harry, don't make fun of 639 or Sierra Papa.
I love that plane.
So much so that I briefly considered having its tail number tattooed on my left bicep.

(57:54):
But you're absolutely right.
In the airbus of my company, we say you have control and I have control and you have control
in a three call verification.
And that's a big part of why non-linked side sticks like those can be approved at all.
Because it's usually really, really clearly defined who is at the controls.
If both pilots are making inputs simultaneously, then shit has probably already hit the fan.

(58:16):
Yes, the A330 also has a crew rest facility right behind the cockpit.
It's used for relief pilots to nap in shifts.
It's not great, but it's adequate.
It's a bunk.
Pilots in that rest area can be notified from the cockpit and summoned back at any time.
In theory, let's post it that.
Yeah.
Okay.
So we've learned about the airbus.
We've learned how it's flown.

(58:37):
Now let's fly to the scene of the crash.
Next slide.
Okay.
So first off, let's meet our pilots.
So on the left, we have Captain Marc Dubois, who is, we're going to call him the Chad.
He's 58 years old, 11,000 flying hours.
Half of them as captain.
He has 1700 hours on type.

(58:57):
Then in the middle we have first officer, Pierre-Cedric Bonnet.
Bonnet?
Bonnet.
Bonnet.
I think it was Bonnet.
Bonnet.
Yeah.
The confused guy extraordinaire.
He's 32 years old.
He has 3000 hours, 807 of them on type.
Most of the rest are on the A320, by the way.
And then we have relief first officer, David Robert, the guy who is also here.

(59:23):
He is 37 years old.
He has 6600 hours, including 4,479 hours on the A330.
He's also a management pilot.
He flies like once a month to keep his type rating current.
I think we should sort of lightly discuss what speculation we may have or information
we may know about the fatigue level of these guys, which is not something that we normally
talk about on this podcast, but I think here it is relevant.

(59:47):
It's always relevant when the information exists.
So anyway, allegedly Dubois brought his girlfriend with him to Brazil and he was said to have
gotten only an hour of sleep the night before.
And specifically we know that because even though the final report doesn't mention this,
various sources who have seen the full cockpit voice recorder transcript say that the cockpit

(01:00:09):
voice recorder in fact captured him saying he had only one hour of sleep sometime before
the start of the officially published transcript, which only covers the last few minutes of
the flight.
So we're pretty sure that's how much sleep he got.
One hour.
Do we actually know whether Dubois' girlfriend was on the flight?

(01:00:29):
I mean, there have been various reports to that effect.
I believe so, yeah.
Also we have-
I believe Bonin also brought his significant other.
His wife, I believe, was on board.
So anyway, we have plenty of reason to believe that Bonin was also fatigued because at one
point about an hour prior to the accident, Captain Dubois offered Bonin the chance to

(01:00:50):
get some rest.
And when he declined, Dubois said, it'll be a lot for you.
And then also at one point he asked if Bonin was okay, which seems odd unless he had some
reason to believe that he wasn't okay.
But we don't really know much more about it than that.
And as for Robert, we really don't know how much sleep he had.
No idea.
He looks kind of surprised to have his photo taken on the slide.

(01:01:14):
Yeah, but-
All right, next slide please.
So the date is the 1st of June, 2009, and Air France Flight 447 is leaving Rio de Janeiro
for Paris.
The flight pushes back at 7.30 PM local time.
And this was an overnight flight.

(01:01:38):
So the crew is going to take turns in the crew rest area.
Robert went there first after they reached cruising altitude.
And from this point on, we're going to use UTC time because this is a long transoceanic
flight.
Local time in Brazil was UTC minus three.
In the mid-Atlantic, it was UTC minus two.
But regardless of which time zone you use, this accident happened in the middle of the

(01:02:00):
night.
And I'm not going to lie, that makes it like at least 50% spookier.
So anyway, let's pick up the story.
At 1.30 AM UTC, they get a request from Brazilian Oceanic Control, which is air traffic control
over the ocean, who ask them to stay at flight level 350, 35,000 feet.

(01:02:21):
This is the last time they hear from anyone or anyone hears from them because after this,
radio over the ocean sucks ass.
And why does it suck?
Well, we're going to turn to our resident engineer, Jay.
Next slide please.
Okay, so this is ionospheric propagation, which is where radio waves bounce off ions
in the high upper atmosphere.

(01:02:43):
This is why they use HF when they're over the ocean and far out of line of sight with
any of the ATC facilities which are on, you know, solid ground generally.
You have to remember that a lot of these systems were instituted before satellite communication
was really a thing and certainly before two-way satellite communication was really a thing.

(01:03:09):
So instead of actually using a satellite to get these signals over the horizon, they use
these clouds of ions that exist in the upper atmosphere, a pair of layers called E and
F. These are ionised air that's created by cosmic radiation mostly from the sun.

(01:03:29):
So it changes markedly between daytime and nighttime.
And you can see here on these two diagrams, for HF radio, there are these things called
first and second bounces and there are skip zones.
You have to understand that this is actually to scale.
So the radius of the earth is 4,000 miles or so, the diameter is 8,000.

(01:03:56):
So to scale, the plane is very close to the ground in these diagrams and so the skip zone
is not somewhere you can get good propagation.
Theoretically, this allows you to communicate over huge distances.
In theory, it can happen that sometimes it works great, sometimes not so much.

(01:04:20):
2009 was very close to the solar minimum and generally, because the sun is less active
at the solar minimum, propagation kind of sucks because these ions are like unpredictable.
The less dense these ions are, the less reflective they are to these radio signals.

(01:04:45):
So the propagation kind of sucks at minimum, it's very unpredictable at maximum.
Sometimes it's decent, sometimes it's totally unusable.
On line of sight, it generally works and over the horizon, you have these things called
skip and fading, which are what they sound like.
It's big areas of the surface of the earth where the radio wave just skips over, it doesn't

(01:05:09):
show up there.
And fading is of course exactly what it sounds.
It's the radio waves getting weaker very quickly, maybe for a minute or two minutes or maybe
for hours.
It's completely unpredictable.
So these two effects, they don't sound good and they just aren't.

(01:05:31):
Of course, because HF can have this amazing range of thousands of miles, anything that
interferes with it can have amazing range too, which can make it noisy and crowded and
it's crowded in unpredictable ways.
Because of course these clouds of ions in the upper atmosphere can move around and they

(01:05:52):
do move around.
Is this why sometimes on, I was going to say, is this sometimes on clear nights, you can
have, if you have an AM radio at the lowest frequency, you can hear, for instance, me
in Atlanta, I can get transmissions from the Caribbean.
Yeah, yeah.
It's a similar effect, but these frequencies are a little higher than that.
These frequencies we're talking about are usually between five and 20 megahertz, which

(01:06:17):
is like the band above your AM radio.
But yeah, it's the same kind of effect.
For the frequencies that AM radio uses, it's much stronger at night because the sun isn't
shining directly on the bit of the ionosphere above you.

(01:06:39):
So you get different effects there, but to a lesser or greater extent, this happens all
the time.
And this makes these bands noisy and crowded and crowded in unpredictable ways.
You might suddenly find you're competing with band users who are thousands of miles away,

(01:07:00):
or you might be in a fading zone where it just doesn't work at all.
And because HF is crowded, the bandwidths you get to use for speech are very narrow,
often three kilohertz or even more narrow than that, which means that the speech is
very distorted, very muffled sounding.
It is, to put it bluntly, is absolute garbage and it can be almost impossible to understand.

(01:07:27):
Fox, I know you've flown a lot of the Gulf, some of the Atlantic.
What is your experience with something like this?
You bet.
Though it's important to note that I'm not a trans-oceanic pilot, so I can't speak to
the unique procedures of ocean crossings or ETAP routes.
However, I do have a ton of non-radar and HF radio experience flying through what's
called the Western Atlantic Track Routing System, better known as the Bermuda Triangle.

(01:07:51):
To borrow the J-type quote, I concur that HF radio is total crap.
There's no better way to describe it.
It's scratchy, almost inaudible due to static a lot of the time, very difficult to get a
hold of the radio operators.
If the operator has a thick accent, you're in for a long flight.
I use the term operator very deliberately because they're not controllers, because they

(01:08:13):
don't have a radar screen in front of them.
You check in with them, you've got your flight plan, and that's about it.
You might give them position reports at certain waypoints, but they don't have any control
over you.
You're just talking to them.
Again, given the scratchiness, it's not uncommon for all attempts to make positive contact
with a radio operator on the provided or recommended HF frequency being unsuccessful, either due

(01:08:34):
to poor reception or frequency congestion.
I myself have flown almost a full hour into the overwatered airspace before reaching a
single human being on HF radio.
So all of this said, Air France 447's poor connectivity with ATC is in no way surprising.
Moreover, you said they don't have a radar screen, there is one kind of radar that can

(01:08:57):
do this, and unfortunately, it interferes with HF radio.
If you've ever heard of the Russian Woodpecker, that's what that is.
It was an over-the-horizon HF radar system that was intended for spotting American bombers
or missiles coming over the pole towards Russia.

(01:09:20):
When they fired this up, it absolutely brutalized HF propagation over most of the Northern Hemisphere
because it worked by bouncing signals in the same band at absolutely massive powers off
this ionosphere.
So it's not just that they don't have radar, it's that they can't have radar, and the

(01:09:44):
militaries that operate radars that can do this make HF radio almost unusable.
Yeah, so point is Air France Flight 447 can't talk to air traffic control or is having trouble
talking to air traffic control from that point on, which adds to the spookiness factor, the
spookiness factor number two.

(01:10:04):
Next slide, please.
It may have also contributed to Bonin's anxiety.
Yeah, we're going to talk about that.
Okay, so we're a few hours into the flight and we're about to hit a nasty patch of weather
that is always there.
It's called the Intertropical Convergence Zone, or ITCZ.
What the ITCZ is, is it's a belt of low pressure that circles the Earth near the equator, and

(01:10:27):
it's where the trade winds of the Northern and Southern Hemispheres come together.
So you can kind of imagine it, if you ever looked at a picture of Jupiter and you see
those bands, those are storm systems moving in opposite directions.
And the Earth has just the same kind of thing, except that obviously we're not a gas giant

(01:10:50):
and we don't have clouds of weird sulfur compounds and things to have these colored bands.
But we do have the same kind of bands of wind that move in particular directions, and where
they come together it's very turbulent.
At this point, the Intertropical Convergence Zone, there's a lot of chaotic and intense

(01:11:15):
convective activity and significant precipitation as these two wind flows sort of bash into
each other and spin off these little vortices.
In other words, the weather usually sucks, and more importantly for our story's day,
it could cause a lot of very screwy and very unpredictable weather conditions, including

(01:11:36):
turbulence and a lot of very nasty kinds of icing.
Including turbulence and a lot of very nasty and insidious kinds of icing.
And let's post it that.
That's foreshadowing.
So Bon-Anne starts looking at his weather radar and he sees some rough weather and he
wants to climb above it.

(01:11:56):
Now there's a possible way around the weather, but they can't get anyone on the radio to
ask for clearance to deviate.
And you can actually deviate quite a lot in oceanic airspace without a clearance, because
oceanic airways are spaced 100 nautical miles apart for good reason, specifically to allow
you to do this?
Now that said, the radars on the bus are actually pretty decent.

(01:12:16):
They're way better than the radars on the regional jet I flew with my previous company.
I mean, my only complaint is that we don't get much training on how to properly use them
early on, in part because of the inability of our simulators to replicate weather and
the radar picture of it on the simulator screens.
About all we do is endure a death by PowerPoint on it in our new hire training and get a very

(01:12:37):
brief familiarization look at it by the Czech Airmen during our initial operating experience
flights.
But that's about it.
And as first officer, we rarely touch the radar controls mainly because they're on the
captain side of the center console.
Most captains I know would get a bit grouchy if the FO reached over and started fooling
around with the radar controls without permission, though newer models radar control panels do

(01:12:58):
have an individual display control for the FO side that they can manipulate at their
discretion.
But to be brutally honest, I didn't get a good read on how the radar works until I upgraded
a captain and gained the authority to start seriously experimenting with it.
Actually a few days ago during a recent flight in preparation for this episode, I told my
FO that I was going to play with the radar controls a bit for my own education.

(01:13:19):
Don't worry, I said, I'm not going crazy.
I just want to see all the possible modes for myself.
So instead, it's mostly on the job learning and it's as much art as science.
You have to know how to subtly manipulate the radar controls and experiment with different
options and even that can be a crapshoot sometimes.
I'm not an engineer and as well first on the technical aspect, so I'll turn it over to
Jay for that.

(01:13:40):
I love the idea of screwing with the radar controls in middle flight and the FO is looking
at you and you go, no, it's okay.
It's for a podcast.
No, ma'am, we're from the internet.
Yeah, true.
Next slide.
All right, next slide.
Okay, so a little bit about weather radar.

(01:14:03):
You can see on the right hand side of this slide that there is a comically small flat
panel antenna inside the radar at the front of this plane.
It's electronically scanned left to right and tilt is achieved by physically tilting
the antenna.
It's mostly a Doppler radar and it can be quite deceptive because of occlusion and limited

(01:14:29):
radar return from water, which is to say radar uses microwaves and water, you may have noticed,
mostly just absorbs microwaves.
I mean, this is how your microwave oven works.
But there is a little tiny bit of reflection, but it is a tiny amount.
If you put watts into some water, you might get microwatts out again.

(01:14:55):
The ability to tilt this thing up and down was first introduced to compensate for the
plane's angle of attack because obviously the nose usually points slightly up.
But it can also be used to get a better picture of what's out there above and below the flight
level.
The display shows a processed image.

(01:15:15):
You can see on the left here, it shows a Doppler effect processed return over a plane on an
arc of about 25 degrees.
The signal you get back from water, as I say, is very, very weak at the best of times.
And if there's a lot of water between you and a giant storm cloud, you're not going

(01:15:37):
to see that giant storm cloud on radar.
You'll just see the shadow that's left by the water that you can actually see.
And because it's so weak, these weather radars have to lean very heavily on Doppler to get
discrimination from ground clutter and receiver noise and, you know, all of these kinds of

(01:15:58):
things, which means that water that's not moving doesn't show up as well, like if it
was a huge band of bad weather around the equator.
Convective systems like the ITCZ can have water in them that's not moving relative to
the ground as the updraft keeps it suspended.
And it's cold up there, so there's quite a lot of ice in them also.

(01:16:22):
And again, the ice return is weaker than liquid water droplets, so your radar can be deceptive
that way too.
Next slide, please.
So we have our crew of possibly sleep-departed pilots flying into a storm that will have
turbulence, will have icing, and they don't really have a way to see how to avoid it if

(01:16:45):
they even can, and they can't even get a controller on the line to tell them that they're
allowed to do this.
And all of these things are making First Officer Bonnard kind of anxious about the weather.
In fact, he gets annoyed that they have to stay at 35,000 feet, because according to
their performance calculations, 37,000 feet was their recommended max altitude at the

(01:17:08):
current air temperature and weight.
And it was Air France policy not to fly at rec max, and they couldn't do 36,000 feet
either because that was a non-standard altitude for eastbound flight, and they couldn't contact
ATC to ask for a special clearance.
And besides, Dubois didn't think one or 2,000 feet would make any difference anyway.

(01:17:29):
If I could chime in, Kira, while Bonnard's suggestion to climb to 37,000 feet might not
allow the aircraft more clearance over the storms, flying at or near the recommended
maximum or rec max altitude, which is shown as a prediction on the FMS, is risky because
the available airspeed range between the minimum and maximum locks, which we pilots call the
spread, can be very narrow, particularly with heavier aircraft, certainly early on during

(01:17:51):
a long-haul flight with a heavier load of fuel on board, like Air France 447.
In turbulent air, it's important for the captain to consider whether their cruising altitude
allows for a sufficient spread that can handle the expected airspeed fluctuations of the
turbulent air.
If the spread at higher altitudes looks to be insufficient based on the predicted rec
max, if the rec max is lower, you kind of have to bite the bullet and either maintain

(01:18:14):
your current altitude or even descend to a lower altitude to give yourself more breathing
room airspeed-wise.
In addition to the Air France SOPs, that could have been Captain Dubois's reasoning.
Yeah, and in the transcript, Bonnard brings up multiple times that he wishes they'd been
allowed to climb to 37,000, but Dubois doesn't seem to be bothered by the fact that they
can't.

(01:18:35):
And in fact, around this time, he decides that he's going to go take his nap because,
again, this is a flight that's more than eight hours.
You can't do more than eight hours on duty.
You got to take a nap at some point.
So for this purpose, they summon Relief First Officer David Robert up to the cockpit and
they have an exchange with Bonnard about how they're going to proceed.

(01:18:59):
Now as of the last episode, from this point on to the end of the episode, we will be each
reading for a particular individual.
So from this point on, I will be reading for Captain Dubois.
I will be reading for Bonnard.
And I'm going to be reading for Robert.
And before he leaves, Dubois says-
Or who's doing the landing?

(01:19:19):
Is it you?
He says that's to Bonnard.
Well he's going to take my place.
You're a PL, right?
Bonnard says, yeah.
Now what didn't happen here was any sort of command decision.
And that is to say that Dubois didn't designate who would be the acting pilot in command.
He only sort of vaguely gestured at who was going to do the landing in Paris.

(01:19:40):
So according to normal procedures, when the captain leaves two First Officers in the cockpit,
which he can do in cruise flight, the Relief First Officer is second in command and the
original First Officer who was already there is pilot in command.
But in this case, the designation is only implicit.
They didn't actually talk about it.
And while both pilots should have been aware that Bonnard was in charge in theory, Robert

(01:20:04):
was actually much more experienced and was also a management pilot.
So that made it difficult to establish a clear division of duties.
And to that I would add that First Officers who were members of augmented crews didn't
receive special crew resource management training for flying with two First Officers on the
flight deck.
So probably Bonnard was not actually very comfortable being pilot in command in this

(01:20:26):
situation.
So this having been said, Robert takes a seat in the cockpit.
Again, it's really not clear who's in command here other than that the rules say Bonnard
is by default.
So the two First Officers discuss the weather situation and Bonnard eventually suggests
a slight course deviation, which Robert accepts.
They turn a bit to the left, but that doesn't really do anything.

(01:20:48):
They didn't really change their flight path relative to the storm very much.
But other flights ahead of and behind Air France 447 made large diversions around the
storm, which, you know, it might have been a good idea, but Air France 447 didn't do
that and we don't really know why.
And certainly Dubois leaving the cockpit for his rest break without explaining what he
thought they should do in this situation was not particularly helpful either.

(01:21:13):
Next slide please.
So they start to fly into the storm and they're feeling the effects of that.
There's St. Elmo's fire on the windscreen that's caused by charged particles impacting
the airplane.
There's a smell of ozone.
Bonnard is getting increasingly agitated by this.
It is not entirely clear why he should be so agitated because he had presumably flown
through similar conditions in the Intertropical Convergence Zone before, but it's clear from

(01:21:37):
the CVR that he was on edge.
So soon they flew into an area of tiny ice crystals within the storm and the sounds of
the crystals hitting the plane became audible.
So these are very cold and dry crystals so they don't cause typical airframe icing and
they might not even be detectable to the crew except by the sound, but they do have one

(01:21:58):
significant effect, which is that the ice crystals start filling the pitot tubes faster
than the heaters can melt and get rid of them.
Now if you have a bunch of material blocking a pitot tube, that's going to block the
ram air from entering the tube, which is going to result in turn in an anomalously low pressure,
which is going to get converted into an anomalously low airspeed by the air data units.

(01:22:22):
In fact, in the case of the Airbus A330 it's a computer called an ADIRU.
In this case, the measured airspeed dropped so quickly that the decrease got flagged by
this ADIRU as beyond the physical capabilities of the airplane, in which case the flight
augmentation computer, which is a separate computer, are programmed to reject these airspeed

(01:22:49):
sources that have displayed this anomalous decrease, which in this case was all three
air data units, so the aircraft was left with no valid airspeed indications.
And if you don't have any valid airspeed indications, then the airplane is going to
switch from normal law into alternate law.

(01:23:13):
Alternate law.
Okay, on the left we have Judge Dredd.
He is the law, brackets normal, predictable, safe, known.
On the right you have Judge Barbara Hershey, less predictable, more volatile.
She is the law, brackets alternate.
So back to seriousness.

(01:23:35):
What is the difference between normal law and alternate law?
Basically, in normal flight, the Airbus will keep you from being a total asshole and doing
something to the plane that would break it.
But we've now lost airspeed indications, so the plane has lost a layer of protection.
Fox, now we get to the good part.
Can you go over what these protections are and what they would indicate?

(01:23:59):
Yes, indeed.
So the Airbus flight control systems have a lot of redundancy with two or three units
of each flight control computer, as well as multiple redundant electrical power sources.
The overall operation of the flight control system is qualified according to what are
known as laws, starting with normal law.
There's a lot to talk about regarding the extent of normal law protection, so I'll keep

(01:24:20):
it simple and focus on the protections these guys on Air France 447 lost.
So first we'll start off with load factor demand and load factor protection.
For pitch control, moving the side stick forward and back does not directly control the deflection
angle of the elevators as J indicated.
It tells the computers to command a positive or a negative load factor, that is, a G change

(01:24:40):
of greater than 1G for increasing pitch or less than 1G for pitching down in exactly
1G for level flight.
In normal law, load factor changes are limited within a range of negative 1 on the low end
to positive 2.5G on the high end in clean configuration and 0 to 2G with landing gear
and or flaps down.

(01:25:02):
Also pitch is limited to 30 degrees nose up in the clean configuration, which decreases
to a maximum of 25 and then 20 degrees nose up with slower speeds and higher flap configurations
and 15 degrees nose down across the board.
So practically speaking, this means that if you pull all the way back on the side stick
as hard as you can, it's going to raise the nose to maintain a 2.5G pull up until you

(01:25:25):
hit the flight envelope limit in pitch and then it will stop.
As long as those limits are there, you can just go full stick back on an Airbus anytime
and you'll be fine.
I don't recommend it, but you won't crash.
And I also want to add-
But Kira, what if I want to join the 410 club immediately after I leave the runway?

(01:25:45):
Yeah.
So I also want to add that controlling pitch using the side stick doesn't just move the
elevators.
It also triggers the auto trim function, which trims the stabilizer to match the commanded
pitch.
So on a conventional airplane, pulling back on the yoke is going to increase the pitch
as long as you hold it there, but it will go back to the trimmed pitch determined by

(01:26:06):
the stabilizer setting once you let go, not so on the Airbus.
When you let go of the side stick, the pitch remains where you set it because auto trim
in the background is moving the stabilizer to match your inputs.
So if you ever flew a plane in a non-flight sim game like Grand Theft Auto, where you
just point it in a certain way and it goes that way, it's a little bit like that.

(01:26:28):
So it's actually really intuitive because this is how most people who don't know anything
about planes think planes actually fly.
And this is completely consistent with the G-load philosophy because if you relax the
controls to neutral, that commands one G, right?
Whereas pitching back down again would require a negative G command.
The next key protection in normal law is roll rate and protection.

(01:26:50):
Again, moving the side stick side to side does not command the ailerons directly.
It commands a roll rate of up to 15 degrees per second.
Maximum bank is 67 degrees, and any bank of up to 33 degrees will be held by the plane
automatically after neutralizing the side stick.
Any bank angle above this requires additional side stick input to the side to hold it, and
releasing the stick will cause the plane to automatically return to 33 degrees bank, which

(01:27:13):
is known as positive spiral stability.
Next is low speed angle of attack protection at Alpha 4.
This is the one that's about to become really goddamn important, so pay attention to this
bit.
As your airspeed decreases, nose up trim will steadily increase the aircraft's pitch and
angle of attack to maintain the desired flight path, again with the intention of maintaining
1G of load factor.

(01:27:35):
However, once the airspeed tape reaches the yellow and black band, it enters the Alpha
protection or Alpha prot range, and a couple things happen.
In this range, the side stick no longer commands a load factor and now requests an angle of
attack, up to and no greater than the maximum AOA known as Alpha Max, which is the bottom
of the yellow, black airspeed tape, and the top of the red tape.

(01:27:55):
No pitches allowed by the computers that result in a higher AOA.
Alpha Max generally is about 5 to 10 knots above the speed that would result in reaching
the actual stealth angle of attack, so there's always a pretty decent buffer preventing an
actual stealth.
Also in normal law, as the airspeed and AOA trends towards the Alpha prot range, the engines
will automatically command TOGA Thrust, maximum thrust, to prevent a stall in what is known

(01:28:18):
as Alpha floor.
Now onto alternate law.
Now, if multiple simultaneous failures of computers or data sources occur, some of these
features can become impossible to maintain, and if that happens, then the flight controls
enter alternate law.
There are actually several variants of alternate law, depending on exactly what failures have
occurred, but we're going to talk about alternate law 2B, which is what happens when you have

(01:28:40):
no valid airspeed indications.
In this law, the most immediate effect is that you no longer have autopilot or autofrust,
so you have to fly it manually.
You also lose your ALA and low speed protections, high speed protections, and bank angle protections.
Roll inputs no longer command roll rate, but are directly proportional with control surface
direction.

(01:29:01):
Pitch inputs, however, continue to work exactly as before, where you command load factor.
Load factor protection is still active, so you won't break the plane by pulling back
suddenly, but there's no longer a limit on pitch angle or ALA, because the computers
need to know how fast they're going in order to determine what the limit is supposed to
be.
So you no longer have an Alpha prot range, no Alpha floor.

(01:29:23):
You just have a hard red tape on the airspeed indicator, which again, gives you about a
five knot buffer above the predicted stall AOA, according to the computer's best guess
based on all the other information it still does have.
Anything below that is going to trigger an audible stall warning.
Yeah, and in normal law, there isn't a stall warning on the Airbus, because the airplane
can't stall, but in alternate law there is, and it calls out stall in a British accent

(01:29:48):
and blinks some red lights.
It's not quite as good as the stick shaker on traditional aircraft, but it's also rarely
necessary, so that's kind of a trade off.
And also depending on the nature of the failures, roll rate command and protection could be
maintained, but as we said, in alternate 2B, which is the one we're going to be talking
about, this feature will be lost.

(01:30:10):
So the side stick becoming directly proportional to the aileron deflection angle makes the
controls extremely sensitive compared to how they are normally.
Something to keep in mind is that the Airbus side stick doesn't have real force feedback.
The estimated roll rate in alternate law 2B with direct deflection is about 30 degrees
per second, twice what it is in normal law, so it can be very easy to over control the

(01:30:32):
roll in alternate law.
Again, alternate law is totally fine normally.
This aircraft is going to be a little twitchy.
It's going to be a little harder to control than normal, but if you are flying level and
all you have to do is stay level, you can just keep doing that.
The Airbus 330 is inherently a very, very stable aircraft.
It wants to fly straight and level.
Or you could not do that.

(01:30:54):
Yeah, hmm.
So I also want to mention that there's this idea out there that I've heard a lot, which
is something like, quote, it's dangerous to just drop the pilot into alternate law all
of a sudden.
It shouldn't do that, which is really kind of weird to me because the airplane is either
capable of maintaining the functions available in normal law or it isn't capable of that.
So alternate law is the adequate compromise.

(01:31:17):
There isn't some middle ground.
So further failures occur.
There is also direct law where all protections are gone and the side stick turns into something
like a Boeing plane where its movements are directly proportional to control surface deflection.
Beyond that, and this is as a result of catastrophic electric and hydraulic and computer failures,
there's mechanical backup, which happens only if you've won out of karma and the universe

(01:31:39):
has decided to screw with you personally in a rather spiteful way.
With mechanical backup, you basically have a dead side stick and are steering mainly
with differential engine thrust, Al Haynes United 232 style, and using thrust changes
to control pitch using the pitch up moment from thrust increases on the low slowing engines.
That said, the purpose of mechanical backup is not to be the hero and land your crippled

(01:32:02):
plane in Sioux City, Iowa.
It's merely to maintain control of your airplane to keep the blue side up until a higher law
like alternate or direct law can be restored through, say, resetting your generators or
hydraulic pumps or deploying your rammer turbine in order to power the emergency generator.
I assume that the entire time you're in mechanical backup or even direct law, your colleague

(01:32:24):
in the other seat is supposed to be running checklists as fast as they can to try and
get out of mechanical backup as quickly as possible?
Not as fast as they can, not frantically.
We're explicitly trained not to rush through E-cams and QRH checklists, but otherwise,
yes, as expeditiously as possible.
The Air France guys absolutely did not do that.

(01:32:44):
And for what it's worth, this wasn't explicitly stated, but in mechanical backup, you still
have control over the rudder and the stabilizer trim because those have a literal physical
mechanical backup.
And I want to add, I only know of one case in history where an Airbus ever actually entered
mechanical backup, which was SmartLynx Estonia Flight 9001, which is an extremely wild story

(01:33:11):
that you should look up and everybody survived it to boot.
Now most pilots in their career will only ever see alternate law in simulators.
So these guys would not have had much experience with how to respond to it.
Depending on the situation, you can lose one, two, or even three flight computers and still
remain a normal law.
Of course, there's an indication that's for the crew.

(01:33:32):
Mostly you'll get an ECAM message that will say, for instance, alternate law, prot lost.
So what that means is that these guys are about to hit turbulence that could upset the
aircraft.
They now have a very touchy and unstable airplane and none of the computer protections that
they think they have, they do have.
All of this happens instantly.
Now if you've got a cool head and you handle it well, this is stressful for a crew, but

(01:33:53):
it can be dealt with.
It happened to a couple of flights on the same route prior to this.
You just need to keep flying the aircraft in a straight line, level as fast as you can.
You rely on the data you do have until the airspeed data is restored.
It's really fairly simple if you've been trained to do it because I know Ari used the word
unstable, but the aircraft is inherently stable, regardless of whether it's in normal law or

(01:34:16):
alternate law.
So anyway, you just make little tiny roll inputs, keep the wings level, and assume a
known pitch and power combination that will result in a stable flight path, and then you
just wait for your airspeeds to come back.
Again, known pitch and power combination.
That did not happen.
So the air...
In fact, there was one incident where an A340 took off with all of the pitot tube covers

(01:34:43):
still fitted, and they somehow didn't realize that this was the case until they were already
off the runway.
Obviously, waiting for your airspeed to come back wasn't going to work in that situation,
but because they realized that, in fact, the pitot tube covers were not in the little box
in the cockpit where they were supposed to be, and they had no airspeed, and were in

(01:35:08):
alternate law, they were able to bring it around and do an emergency landing just by
being really, really careful without having to do anything heroic.
Right.
They used common sense, pitch and power combinations that resulted in known predictable flight
paths and at airspeeds.
So the airspeed drops offline, the autopilot disconnects with a cavalry charge alarm.

(01:35:30):
This catches Bo not completely by surprise.
Our accident sequence is about to start, which brings us to...
Next slide.
And whoop, whoop, pull up.
So we've had a good background on all the important pieces.
We now have a very touchy and to its crew unpredictable airplane in known turbulence,
and it's giving them no airspeed data.
So we've had a good background on all the important pieces.
We now have a very touchy and to its crew unpredictable airplane in known turbulence,

(01:35:53):
and it's giving them no airspeed data.
Admiral C, all yours.
Okay, so everything goes to hell almost immediately.
Because with the autopilot off, there's nothing compensating for the turbulence of the storm
they're inside of.
So the plane enters an uncommanded eight degree roll to the right.
And this isn't a really serious issue.

(01:36:13):
You just roll wings level.
So Bo now immediately announces that he has control and he grabs the side stick and he
tries to roll level, but because he's in alternate law and the stick commands aileron deflection,
the plane rolls a lot faster than he is expecting to.
And within a second or two, he's into a feedback loop, banking back and forth out of phase

(01:36:34):
of the airplane's movements.
So the bank angles involved here aren't very large, but he's also not really in control.
And as he's manhandling the controls, he starts to pull back on his stick, not to the max
or anything, but steadily back, commanding a positive load factor, which is going to
make the plane climb.
And this really isn't what you want to do in this situation, because not only is it

(01:36:57):
not the appropriate reaction to a loss of airspeed indications, it's just generally
a bad idea to pitch up significantly when you're at 35,000 feet, because the stall angle
of attack is so low, and I'll get to why in just a moment, but first I want to ask why
on earth did he do this?
And the short answer is we don't really know, but there are a lot of different potential

(01:37:17):
factors involved here.
So first, it's possible that his input wasn't even conscious, and he was just white-knuckling
the side stick due to adrenaline and stress, barely aware of what he was doing as he focused
on trying to control the bank angle.
Or maybe second, he had earlier expressed a desire to climb over the storm, so associating
the abnormal situation with the storm, he might have been primed to try to climb as

(01:37:41):
a sort of escape maneuver out of a place he was uncomfortable being.
Or third, maybe, at the moment the airspeed became unreliable, there was actually a deviation
in indicated altitude and descent rate, and that's because the way the plane measures
altitude is via the static ports on the bottom of the fuselage, but error is introduced into

(01:38:02):
the static pressure measurement due to airflow over the fuselage, which can only be compensated
for if the air data units know what the airspeed is.
So if the airspeed is erroneously low, then the indicated altitude will also be slightly
too low, and on flight 447 this loss of airspeed indications was therefore accompanied by an

(01:38:24):
approximately 350 foot decrease in indicated altitude, and more importantly an indicated
650 feet per minute descent rate, neither of which was actually happening, the plane
is in level flight.
But this could have caused Bonin to pitch up if he saw it, but we don't know that he
did see it, he didn't say anything about it.

(01:38:44):
And fourth, somewhat corollary to third, it's also possible that Bonin became concerned
about over-speeding the aircraft.
Because in cruise flight the A330 is much closer to its maximum operating speed than
its minimum operating speed, so that upper red line on the airspeed indicator is always
in view, until all of a sudden it went away as they entered alternate law, because the

(01:39:07):
computer can't calculate where the line is supposed to be.
So he might have had an intrinsic fear of getting too close to that line, prompting
a semi-instinctive pull-up, especially if he thought the plane was descending.
And this is unfortunately not as big of an issue as a lot of pilots believed at that
time.
In fact, the A330 is pretty difficult to get going fast enough to do any real damage unless

(01:39:31):
you're deliberately trying to break it.
So he shouldn't have been worrying about that.
But in any case, it could have been any of these factors, or maybe a combination of several,
or maybe it was something else.
We don't really know and never will.
But what we do know is that he pulled back on the side sticks, so the plane started to
climb, alarms are still going off about everything that's been disconnected, and Bonin has been

(01:39:55):
in alternate law for about 15 seconds, and that was enough time already for the stall
warning to activate briefly.
And that's because- Stole, stole.
Yes, that.
That's because Bonin is putting the airplane into a 6900 feet per minute climb, which is
totally unsustainable at 35,000 feet.
He's trading kinetic energy for height, and he's riding the hairy edge of the stall AOA

(01:40:19):
here.
And it should be noted that especially at that time, the momentary activation of the
stall warning while climbing at high altitudes is something that caught a lot of crews by
surprise.
Because training always emphasizes that the plane stalls at only one critical angle of
attack, which is great advice, normally, but that's not technically true, because the stall

(01:40:39):
AOA is also affected by Mach number.
So the higher your Mach, the lower your stall AOA.
And in fact, at low altitude, you might expect a stall warning at an AOA of 10 or 11 degrees,
but at 35,000 feet, you can get the warning at 4 or 5 degrees.
In previous incidents, crews had described hearing a stall warning under similar circumstances,

(01:41:02):
and they believed it had to be false because they were nowhere near what they believed
the stall AOA should be.
So it's ultimately not clear whether the crew even noticed this first brief stall warning,
but immediately after it, First Officer Robert said, what's that?
And we don't know for sure if he meant the stall warning.
But it has to be noted that stalls in alternate law, which is again the only time you'll ever

(01:41:25):
hear the stall warning, these are only practiced during initial training and not during recurrent
training.
First Officer Robert probably hadn't heard the stall warning in about 10 years.
And with that in mind, and the fact that he was a native French speaker, and the warning
was in English, it's possible that the brief 2-3 second activation was just not enough
time for him to comprehend what the warning was actually saying.

(01:41:48):
And then again, or then again, just as I just said, even if the pilots did comprehend it,
there's a good chance they would have disregarded it anyway.
So as this is going on, Bonnard acknowledges the airspeed issue.
He's saying we haven't got a good display of speed.
And Robert acknowledges that they have quote, lost the speeds.
So then he begins reading the alert messages on the ECAM display.

(01:42:11):
This is part of his duty as pilot not flying.
But according to proper procedures, this should come only after ensuring the flight path is
stabilized, which it currently wasn't because Bonnard is pitching close to 16 degrees nose
up.
So he calls out that the autopilot is off and they're in alternate law, but it doesn't
seem that Bonnard has grasped the consequences of that.

(01:42:33):
Because notably the ECAM doesn't say, hey, your pitot tubes are frozen.
And it could have been designed to mention that because the reason for the flight law
change was stored internally, but it wasn't presented to the crew.
And to my knowledge, it still isn't.
So the crew are trying to figure this out.
And all the while, flight 447 is climbing past 37,000 feet, trading speed for altitude

(01:42:56):
and bleeding off kinetic energy faster than the engines can add it back in.
And at this point, Bonnard has set the engines to the climb power detent, but that wasn't
enough.
There's no engine power setting that will allow such a steep climb at that altitude.
At 37,000 feet, the difference between climb power and Toga power is in fact minimal.

(01:43:16):
So even applying Toga power wouldn't have made any difference.
But as this is happening, Robert finally notices that they're losing airspeed and he calls
out, Jay, what's your speed?
What's your speed?
Okay, okay, okay.
I'm going back down.
So Bonnard pushes the nose down a little bit, which slows the climb, but he doesn't actually
level off or descend to build speed back up.

(01:43:38):
And for some reason, he reduces the engine thrust for about seven seconds.
And remember, this is all happening because Bonnard doesn't understand that he's flying
without guardrails.
And in normal law, if he tried to do this, the computer would have said, fuck you and
your dumb ass Bonnard.
I'm lowering the nose and you can piss off if you don't like it.
But now they're in alternate law and the computer says, well, there's only so much I can do.

(01:43:59):
Your funeral.
Um, so anyway, continuing the recitation of this cockpit voice recorder transcript here,
Jay.
Go back down.
According to that, we're going up.
According to all three, you're going up.
So go back down.
It's going.
We're going back down.
And then he put the engines in Toga.

(01:44:19):
But again, he's still climbing.
But again, as I said, putting the engines in Toga at this in the situation provides
no significant additional thrust beyond what climb power was giving him earlier.
Um, and in fact, as a throwback to our Pinnacle Airlines episode, we can say they were now
way off the back end of the power curve.
It was impossible to maintain their current flight path at any available power setting.

(01:44:42):
But so why does Bonnard keep climbing even after this conversation has occurred with
Robert telling him go back down?
For one, the pitch, angle and power setting that Bonnard is using are within what he conceives
to be the normal operating envelope, just not at 37,000 feet.
This would be fine at low altitude.

(01:45:04):
But Bonnard doesn't really have a full appreciation for the difference between handling at high
altitude and handling at low altitude because this is an A330.
It's the most it's an incredibly advanced airplane.
There's no reason to ever hand fly it at altitude.
There's also no evidence that he understood at this point that they were an alternate
law or what the implications of that were.
So he likely still believed that the airplane wouldn't let him exceed the flight envelope.

(01:45:30):
But there's also another potentially huge issue here, which has to do with the flight
director.
So the flight director is an overlay on top of the pilot's primary flight displays that
tells them what pitch and roll inputs to make in order to achieve a specified flight path.
It's a really helpful guide to use when hand flying with the autopilot off.
In fact, these guys probably never flew a hand flew the A330 in line operations without

(01:45:55):
the flight director guidance.
It massively reduces workload in manual flight.
It's normally very trustworthy.
And also, unlike the autopilot and autothrust, the flight director doesn't automatically
turn off when airspeed indications are lost.
Instead it's just inhibited while remaining turned on in the background.

(01:46:15):
The flight director then comes back when the airspeed readings are close enough to each
other to be considered valid again.
But when it comes back, it commands inputs to maintain whatever flight path the plane
is currently on until the pilot selects a particular operating mode.
So in this case, the flight directors came and went several times during flight 447's

(01:46:37):
climb, but eventually they came back and they mostly stayed back, and at the time that occurred
the plane was climbing at about 1400 feet per minute, so the flight directors began indicating
an approximately 12 degree pitch up command, which would result in the specified climb
rate at their current thrust setting if they had any kinetic energy, which at this point
they didn't, so it was useless.

(01:46:58):
And the flight director doesn't tell you how to fly out of a stall, and it's never going
to provide useful information in an approach to stall situation in alternate law.
Just to get that out there.
And Bonnard never commented on the flight director, but the flight data generally supports
the argument that he tried to follow it at various points after it returned, because

(01:47:19):
following the flight director is normally so ingrained that it would have taken some
level of situational awareness to consciously recognize that its commands were unhelpful
and to reject them, but Bonnard clearly did not have such awareness at this point.
So if he was pitching up to follow the flight director, then that could explain why he thought
his measly little pitch down was enough to satisfy Robert's concerns about their flight

(01:47:43):
path.
Meanwhile Robert has by now realized they're both helplessly in over their heads, so he
starts frantically mashing the call button to the crew bunk area to try to summon Captain
Dubois to help them out.
As this is happening, at time 2, 11, and 10 seconds, so that's just after midnight local

(01:48:04):
time after 2am UTC, this is about a minute after the autopilot disconnect, they reach
their peak altitude of 37,924 feet, at which point the airplane stalls.
So to talk briefly about basic stall aerodynamics, first, increasing the angle of attack, that
is the angle of the chord line of the wings to the relative wind or the oncoming air,

(01:48:27):
that increases lift until the critical angle of attack is reached, where the boundary layer
of air moving over the top of the wing begins to separate from the upper surface, become
turbulent, this causes buffeting, and then the lift drops off and the wing stalls, which
you have a very, very simplified drawing of this on the top of your screen.

(01:48:49):
And in the bottom of your screen is a basic depiction of what the flight path of the aircraft
is going to look like when it's in this kind of nose-high stall.
So and to that I also want to make sure everyone is aware, lift is a function of airspeed as
well as angle of attack, so if as airspeed falls, angle of attack has to increase in
order to maintain the flight path, we've been over that one.

(01:49:12):
It's also a function of air density and therefore altitude.
Yes.
I myself have never stalled an airplane in my life, and I hope to God that I never do.
I'm not a test pilot either, so my impressions of airplane installs are based solely on my
time in our simulators, which I'll touch on in the aftermath, but the first thing you
need to know is that the stall they had just entered is nothing like the kind of stall

(01:49:33):
you may be picturing or may have practiced in a Cessna.
The buffing experience at the onset of a stall in an airliner is extremely violent, way more
than that in Cessnas, to the point where reading the instruments becomes difficult from a shaky.
Second, stalls in Cessnas experience an uncommanded nose drop known as a G-brake at the onset.

(01:49:54):
This is because the center of gravity of Cessnas is far forward because of the front mounted
engine.
On airliners, the CG is closer to the wings because of the wing mounted engines, so you
might get little or no uncommanded nose drop.
The pitch attitude of the aircraft might not change much, even if the true flight path
of the aircraft is ascending rapidly, as the graphic shows.

(01:50:14):
In other words, you might stay pointed in the same direction while you're falling out
of the sky.
Yeah, and in this case, you're definitely not going to get any G-brake, no matter where
the center of gravity is, because Bonnard is still holding the side stick back, commanding
a steady 1.3G of load factor, or somewhere around there.
So that means that the elevators and stabilizer aren't holding a particular pitch angle,

(01:50:38):
rather they're continuing to increase the pitch angle with every passing moment, because
the only way to maintain a load factor greater than 1 for any length of time is to keep making
the climb even steeper.
So by the time the plane stalls, both the elevators and stabilizer trim are at essentially
full nose up, even though Bonnard never pulled his stick more than about halfway back.

(01:51:02):
So the airplane stalls.
The angle of attack soars above 35 degrees.
It never actually went below that again.
The airplane began to fall on a long downward arc, with its nose high in the air.
The engines are at toga power, but that's not going to help.
At this point, recovery would have been quite involved, because it would have taken a massive

(01:51:23):
pitch down to correct the incredibly high angle of attack, and Bonnard would have needed
to hold his side stick at full forward for a considerable length of time to do this,
which is an incredibly unnatural input, because the airplane's response wouldn't have been
instant.
Due to the length of time he had been pitching up, the stabilizer trim, as I said, was at

(01:51:45):
full nose up, and it would take quite a prolonged nose down input for the auto trim to drive
it back out of that position.
But instead of attempting this extreme maneuver, Bonnard was mostly focused on his completely
futile efforts to control their bank angle.
The plane was swaying quite dramatically, up to 40 degrees to the right at one point,
even with side stick at full left, because aileron authority in a stall on a swept wing

(01:52:09):
aircraft is quite poor.
Robert suggested to him to touch the roll control as little as possible, which, I mean,
yeah, but it's also a little bit late for that.
You have bigger problems.
And I also want to emphasize that around this time, actually a couple seconds before the
plane stalled, the airspeed readings became valid again, because the heaters had cleared

(01:52:29):
all of the ice out of the pitot tubes, they were no longer obstructed.
But the pilots never really recognized this, and I don't think they ever again believed
their airspeed indicators at any point after this, because again, the real airspeed now
is extremely low, which their erroneous airspeed earlier was also extremely low.
The difference between readings isn't obvious to them.

(01:52:51):
At this point, Bonnard says, I'm in toga.
And it seems they couldn't figure out why they were losing altitude if they were in
toga.
So the plane is also shaking this whole time, because large swept wing airliners experienced
the onset of a stall with a very violent way, as Fox said.
Different parts of the wing stall at different times, it can be difficult to read the instruments.

(01:53:13):
All of this made Bonnard's situational awareness and his panic even worse.
Now, not only was the high thrust not helping, it could have even been actively harmful,
because while additional thrust can help stall recovery at low altitude, it's a double-edged
sword.
Earlier, when Fox was talking about manual backup, he said that increasing thrust on

(01:53:34):
low slung wing mounted engines creates a pitch up movement, which is exactly the opposite
of what you want during a stall recovery.
And if you're not careful, it can put you into secondary stalls.
And remember, they're in a control law where the plane isn't protecting them from this.
Normally, the plane would compensate for that automatically.

(01:53:56):
I would also add that in the thin atmosphere at high altitude, the margin of available
excess thrust is very low, so increasing power to Toga will do very little to help with recovery
from high altitude stalls.
So if they needed more thrust to overcome their extreme angle of attack, would they
have engaged their official Jack Parsons brand JTOW bottles?
Yes.

(01:54:17):
That would have done it.
Actually, Erie, speaking of those, if you remember back in episode 5 when we talked
about stalling at flight level 410, this is similar in that this was a high altitude stall,
and it was totally recoverable.
And that's why I can't stress this enough.
Your first priority should be to push the nose down, not increase thrust, and hold it

(01:54:37):
down, especially at high altitude.
Because of the lack of additional excess thrust, your best bet is to lower your angle of attack
above all else and regain proper lift by using gravity to your advantage.
But that would require Bonin to know that he's in a stall, and also to know that a high
altitude stall is different from a low altitude stall.

(01:54:58):
And really it seems like he has no idea what's going on whatsoever.
And Robert doesn't know what's going on either.
Because he says,
But we've got the engines, what's happening?
Do you understand what's happening or not?
This whole time the stall warning is blaring, but neither pilot comments on it.
Because hearing is often one of the first things to go when we're under extreme stress,

(01:55:20):
and it's possible they just didn't process that stall warning amid all the other alarms
and noises that were bombarding them.
So by this point, Bonin has completely lost the plot.
He's shut down out of confusion.
I don't have control of the airplane anymore now.
I don't have control of the airplane at all.
That's what he says.
And right about now is when the chances of this being a recoverable situation started

(01:55:42):
to drop really rapidly.
Next slide please.
Okay, Fox, would you walk us through how they could have recovered at this point?
Yes.
This was not an unsurvivable situation given the altitude they stalled from.
Pfts do have something called the flight path vector function, a little button to toggle
it on the flight control unit near the autopilot controls, affectionately known as the BIRD,

(01:56:06):
that can be selected on the PFD and is very helpful in a stall situation.
In fact, these days with our improved simulator stall training, I ask my FO to turn it on
every time.
If you push the nose down and point the airplane nose indicator on the PFD, which is a small
square directly at the FPV, you know that you're in a zero-G regime without any additional
angle of attack, so you've found the ideal pitch attitude for regaining sufficient airflow

(01:56:29):
over the wings and getting out of the stall regime.
Now you and everyone else on board will float in their seats and seatbelts and you'll have
a great resume bullet for your dream job flying the vomit comet, but you will have successfully
unloaded the wing as needed to regain airflow and recover.
And we should note that the flight path vector thing was never selected by this crew, and

(01:56:50):
even if they had tried to select it, it was unavailable during most of the descent because
it can't be displayed if there aren't valid airspeed readings.
As I mentioned earlier, the airspeed readings actually became valid again around the time
of the stall, so it would have been briefly available, but during Flight 447's descent,
the angle of attack got so high, at one point it was as high as 60 degrees, that the oncoming

(01:57:14):
air was blasting directly against the static ports from below while almost missing the
pitot tubes entirely, resulting in a static pressure reading that was higher than the
dynamic pressure reading, which would result in a negative airspeed value, and that's obviously
nonsense so the computer rejects that data as invalid and the flight path vector bird
therefore would have been unavailable even if the pilots did try to use it, which again

(01:57:37):
they didn't.
And even during the times that it was available, the angle of attack was still so high that
the bird likely would have been off the bottom of their primary flight displays.
Even without the bird, you should push the nose down as required to regain airspeed.
Once your airspeed is out of the stall regime and continuing up on a positive trend, you
could commence the pullout from the stall recovery, but you weren't out of the woods

(01:58:00):
yet.
If you pull out too prematurely, you risk a secondary stall.
If the airspeed indicators on 447 had remained faulty, re-encountering the stall buffet or
the audible stall warning could have helped the crew know that they had begun the pullout
before regaining sufficient airspeed.
Next, even once your airspeed is well out of the stall regime, it will be increasing rapidly

(01:58:21):
from the dive angle.
At a high altitude with narrow margins between the stall regime and the maximum lock speed,
you have maximum g-consideration to think about during the pullout.
Thus, you have to use an extremely delicate touch on the side-sink to avoid exceeding
the maximum 2.5 g's.
During our unhanced envelope training EET sims, while the pilot flying is executing

(01:58:42):
the pullout, the pilot monitoring is trained to call out the g-count on the lower central
ECAN display every second or two to avoid exceeding the maximum load factor.
The PM might say 2 g's, 2.1 g's, 2.2 g's, 2.1 g's, and so on.
Even if the speed creeps into the maximum speed mock range during the pullout, over-speeding

(01:59:04):
the aircraft is more acceptable in the long run than over-g-ing it in terms of risking
aircraft structural damage.
And that's all great advice, but in any case, these guys didn't do any of that.
In fact, they didn't do anything at all, because Bonnard was still making nose-up inputs.
Next slide please.
So around this time, Robert tries to take control, but mostly because he's worried

(01:59:27):
about the bank angle.
But as soon as he does this, Bonnard simply presses the priority button on his side-sink
to give himself control back, at which point Bonnard says, and Jay is going to read this
because we're going to use the original French, and Jay is the one here who speaks French,
but this is Bonnard, not Robert.
J'ai l'impression qu'on vitesse de fou, non?

(01:59:49):
Qu'est-ce que vous en pensez?
Yes, and that loosely translates to, quote, I have the impression that we're going crazy
fast, what do you think?
So that phrase stuck out to me, really, in the CDR transcript, so I wanted to kind of
zoom in on it.
I'm speculating a bit here, but my read is that because they didn't trust their Earth
feed data, the buffeting they experienced made them think that they were flying too

(02:00:11):
fast instead of too slow.
I can understand this a little bit.
All of us airline pilots are guilty from time to time of flying a bit too fast through
turbulent air, and from personal experience, flying at high speed through moderate turbulence
does bear a slight resemblance to the stall buffet that our simulators replicate, especially
if you've received poor or no training on what a stall actually feels like.

(02:00:32):
Yeah, although in fact, according to various sources I read, the A330 doesn't experience
much high speed buffet or mock buffet, so if he had known that, then he might not have
mixed that up.
But anyway, it was around this time that Captain Dubois finally came back into the cockpit,
and he found there total chaos.

(02:00:54):
So the first thing he says is, what are you doing?
Robert says, what's happening?
I don't know.
I don't know what's happening.
We're losing control of the airplane.
We lost all control of the airplane.
We don't understand anything.
We've tried everything.
You've tried nothing, and we're all out of ideas.

(02:01:15):
You've tried nothing, and we're all out of ideas.
You haven't tried pitching down, asshole.
You haven't tried everything.
You've just tried point the nose at space, and then you gave up.
One detail that we should emphasize again is that the stall warning is going the whole
time.
Over and over again, you just hear a very bored British man saying, stall, stall.

(02:01:41):
It's also shouting dual input, dual input quite a lot as well.
Meanwhile, the whole time the airplane is still nose high, falling like a brick, neither
Bonin nor Robert trust their instruments, even though actually most of their instruments
are valid at this point.
Bonin said he had no vertical speed indicator, and he and Robert both said they had no more

(02:02:02):
displays, but as far as we know, everything was working.
And again, the airspeed indication was accurate again by this point.
So Robert says, we're pulling.
What do you think about?
What do you think?
What do we need to do?
And then Dubois says, there, I don't know.
It's going down.
Excellent addition, Captain D. I'm glad we've gotten you out of bed.

(02:02:22):
You are a real value add in the situation.
In all seriousness, him saying it's going down was a pretty valuable thing because at
this point Bonin is so confused.
We're not even entirely sure if he understood that the plane was in fact descending.
And actually another fucked up thing that was going on here is that when the angle of
attack went above a certain value and the airspeeds became temporarily invalid due to

(02:02:47):
being less than the static pressure, as I described earlier, that also caused the flight
director to disappear and the stall warning to stop.
Because again, the readings are absurd, it can't do anything based on these.
But sometimes Bonin would pitch forward a little bit and the angle of attack would decrease

(02:03:07):
just enough to make the data valid again.
And then the stall warning would come back and the flight director would return commanding
the same 12 degrees nose up it's been commanding this whole time.
So it's been suggested that this cycle was programming Bonin with a Pavlovian reaction
to pull back up every time he started to pitch down.
Which maybe, but we don't really know what he was thinking.

(02:03:29):
At this point the cockpit descends to even further chaos beyond the chaos it was already
in.
So Captain Dubois says, the wings to flat horizon, the standby horizon.
The horizon?
Speed?
You're climbing.
You're going down, down, down.
Am I going down now?
Go down!
No, you're climbing.
I'm climbing.

(02:03:49):
Okay, so we're going down?
Okay, what are we here?
On altitude, what do we have here?
It's impossible.
Okay, we're in toga.
What do you mean on altitude?
Yeah, yeah, yeah, I'm going down, no?
You're going down, yes.
Hey you, you're in get the wings horizontal.
Get the wings horizontal.
That's what I'm trying to do, I'm at the limit with the roll.

(02:04:11):
We lost it all, I've got nothing here.
We're there, we're passing level 100.
It's pretty evident from the CVR transcript that for almost the entire length of the descent,
no one in the cockpit had any situational awareness.
Bonnard and Robert continue to trigger the dual input warnings.
Bonnard continued to not understand why they're descending.
And finally, Dubois figures it out at around 9,000 feet, which is way too late because

(02:04:37):
Bonnard said at that point, hey, I've had my stick back this whole time.
And so, Dubois yells at Bonnard to stop trying to climb.
And then Robert demands the controls and he pitches down a little bit, reaching an almost
level pitch attitude.
But actually, and actually at one point, they were even about five degrees nose down, although

(02:05:00):
still stalled.
But then Bonnard just started pulling it back again without saying anything.
And it wouldn't have mattered anyway because they hadn't had enough altitude to recover
since about the time Captain Dubois came back anyway.
So at a few thousand feet, the ground proximity warning system goes off and Bonnard and Robert
start pulling up because as Bonnard says, we have to, we're at 4,000 feet.

(02:05:23):
To which Captain Dubois says, go on, pull, as though he's totally resigned himself to
their collective fate.
And then in the last moments, Bonnard says, we're going to crash, this can't be true,
but what's happening?
And then Dubois ordered 10 degrees pitch attitude.
And then two seconds later, still in a mostly wings level nose high orientation, they hit
the water with a descent rate of around 11,000 feet per minute.

(02:05:48):
And all 228 people on board were killed instantly.
So next slide.
So let's talk about the aftermath.
So in the immediate aftermath, it takes two hours for control in Senegal to realize that
447 never showed up.
And then it's another hour and a half before the search and rescue process has even started.
And it's until nine hours after the impact that the first search plane takes off from

(02:06:08):
Brazil.
This was mostly due to a lack of clarity about which control center was responsible for coordinating
the efforts to find a plane that went missing deep in international waters while not in
communications with any of them.
There's a problem.
They know the plane went missing.
They just have no idea where.
And the wind and the waves in this area are brutal, so the debris is scattering and sinking
fast.

(02:06:28):
They know the general area where the plane went down thanks to ACARS, which automatically
sends updates from the plane to the company via satellite for maintenance purposes.
ACARS issued several non-routine updates as the plane went down, but the last position
report was a couple of minutes before impact and there was no radar coverage.
Nevertheless, this was enough for them to find wreckage and bodies within about three
days after the crash.

(02:06:48):
Because of the faults recorded in the ACARS data, the BEA and Air France immediately knew
that this was probably related to the pitot probes.
Air France and Airbus already actually knew that there were more reliable pitot tubes
available for the 330 and had actually started retrofitting them.
The first one, in fact, the same day as the accident, but not on the accident aircraft.

(02:07:12):
Obviously, yeah, not on the accident aircraft.
So by the end of the month, they'd found a good number of parts scattered across a
wide area, including the tail, which gave us the iconic photo that's in the thumbnail
for this episode.
The 30-day window for finding the CVR and the FDR before their locator beacon batteries
died came and went.
Now a lot of the wreckage fell along the Mid-Atlantic Ridge, which is a massive mountain range that

(02:07:34):
extends from Iceland to Antarctica.
So they were scanning an area the size of Switzerland, with even more hostile terrain.
They scanned 22,000 square kilometers of ocean and found nothing.
In fact, they spent nearly two years looking and were close to calling off the search entirely
for lack of funding.
But they did.
They did another round, round four, and this time they performed what's known as a Bayesian

(02:07:57):
analysis to determine probability with better accuracy.
The details of how this worked aren't really relevant to us, but the short version is that
they found the wreckage area with calculus.
Seriously, they used math to determine a likely area, then they sent an autonomous sonar probe
down to map the seafloor, and two years after impact they found the rest of the wreckage,
3900 meters below the surface, 12,800 feet.

(02:08:19):
It's deeper than the Titanic by about 300 feet.
At that depth you're talking about 5,500 pounds of freezing water pressing on every
square inch.
And beyond the search for the CVRs, this investigation was just kind of complicated.
Even before they recovered the black box, they knew the plane had belly flopped into
the water at low speed, but they had no idea how that could have happened.
Interestingly, the reason they knew this is because they'd recovered a galley, and they

(02:08:42):
noticed that it was pancaked up from below and not squashed front to back, which indicated
that it had a very high vertical velocity and a very low horizontal velocity.
Next slide please.
So discovering the CDR and the FDR was a big break in the case, but it was by no means
the end of the story.
Because those items revealed what happened, the why is a little bit more complicated.

(02:09:04):
So how does a fully trained, qualified wide pod pilot just forget how to fly a plane?
The answer to that is both simple and a little complicated.
So the simple answer is that Bonin went through training and quickly became qualified on Airbus
fly-by-wire aircraft, having only a couple hundred hours on smaller airplanes before
going to the big buses.
As such, he never developed what you would call a feel for aircraft or an understanding

(02:09:28):
of how they might behave, especially at the limit or in an extreme upset at the edge of
the flight envelope.
And I should note that while more time in small aircraft helps with this, theoretical
training is really important too.
And this stuff was covered in theoretical training, but clearly it was not effective
enough, as Bonin hadn't assimilated it.
If he had, then he would have understood why you can't just pull up at 35,000 feet and

(02:09:52):
why you can be descending with a high pitch and engines at Toga.
Bonin probably saw himself not as a pilot in the traditional sense, but as a pure systems
monitor who believed at the bottom of his heart that his aircraft would not allow him
to do something catastrophically stupid.
And when this turned out not to be the case, he found himself unable to adapt his mental
picture to it in time.

(02:10:14):
Now as to why it's complicated, let's talk about simulators real quick.
So Bonin had been given some instruction on stalls, but his training was death by PowerPoint.
Sim training was minimal, and bad stall training is worse than no stall training.
See if your stall training is insufficient, you increase the risk of applying the right
procedures to the wrong scenario.

(02:10:36):
One that we discussed among ourselves is that not understanding the difference between stalls
at different altitudes, the AF447 crew applied low altitude, perhaps post takeoff stall procedures.
That is, maintain gentle 15 degrees nose up, apply Toga power in order to get away from
the ground.
And that works if you haven't already stalled, because that performance combo is perfectly

(02:11:01):
acceptable at low altitude.
You will not stall the plane if you're 15 degrees nose up with Toga power.
But it doesn't work at cruising altitudes.
Jay is going to say a little more about that.
At cruising altitudes you have about a third as much air available to provide lift as there
is at sea level, so any significant attempt to pull the nose up and hold it there will

(02:11:22):
induce a stall with frightening ease when there's no normal law protections available
to stop it.
And moreover, there's only a third as much air for that big fan on the front of your
Trent to actually push backwards to give you thrust.
And Fox is going to talk about this more in just a minute, but the way stalls were taught

(02:11:42):
at that time was just completely inapplicable to this situation.
Stall training was designed to show you two things.
First, how to power out of a low energy situation on takeoff or landing, as we described, or
second, how to react to airspeed decaying towards stall in level flight, which Fox is
going to describe.

(02:12:03):
But in neither case would the simulated airplane actually be allowed to stall, because simulators
weren't programmed to accurately reflect the performance of the airplane past the actual
point of stalling due to insufficient real world data.
So that meant that while Bonnard would have been taught in theory that you have to pitch
down to reduce AOA to escape a fully developed stall, he was not able to recognize that such

(02:12:26):
a situation existed and apply this purely theoretical procedure.
How to recognize the approach of a stall in a high altitude climb wasn't either, because
what they were doing was, again, level flight, slowly decreasing airspeed.
And I also want to hammer this home.
If a pilot is in a high stress situation, they're very likely going to apply the solution

(02:12:50):
that they've rigorously practiced and nothing more.
You can't count on critical thinking occurring.
In this case, all Bonnard probably knew was, hold a reasonable nose up pitch attitude and
apply toga power and everything will be fine, and he just kept trying to do that all the
way down to the ocean.
And just like last episode with the speed brakes, we want to emphasize in a high stress

(02:13:14):
situation, pilots are more or less only going to be able to do things that have been practiced
to the point of muscle memory.
When alarms are going off, the plane is falling out of the sky, whatever shit they got on
a PowerPoint slide once is going right out the window.
So I'm not risking pissing anyone off when I say that our previous stall training and
that of most of the airlines used to be garbage.

(02:13:36):
What we would do previously was start off flying straight and level with the autopilot
engaged.
Our instructors would pull the thrust levers back to aisle and we would pretend not to
even notice as our pitch attitude angle of attack gradually increased.
Then at the first indication of a stall, either light buffeting, which the older simulator
fidelities could replicate, or the autopilot clicking off in accordance with the Alpha

(02:13:56):
prot logic, we would seize the controls, press the red disconnect button on the side stick
to ensure that the autopilot was disconnected, push the nose down and execute a smooth recovery.
This was a fairly decent demonstration of Alpha prot doing its job, but it's important
to note that due to the considerable buffer Alpha prot, Alpha max, and even VSW and alternate
log give us above the actual stall angle of attack, we never actually entered the stall

(02:14:19):
regime or experienced any of the savagery that constitutes a full stall in a swept wing
airliner.
And not only did Bonin react poorly to a stall, he fundamentally couldn't even understand
that he was in a transient, unreliable data data regime or how to respond.
When we were researching for this episode, we actually noted that the BEA looked back
at about a dozen cases of A330 and A340 aircraft losing airspeed data, and in zero of these

(02:14:45):
cases did the pilots identify the issue correctly.
One of them even raised the nose in the exact same way as Bonin did, but not to a degree
to actually cause a stall.
And among the reasons for this was that the unreliable airspeed scenario, as depicted
in training, was not all that similar to how it tended to happen in high altitude crews.

(02:15:07):
And if the training isn't realistic, then it's not going to automatically kick in during
a real emergency, as we said.
One of the contributing factors for this crash was also in parts that the two controls were
linked as we discussed.
Now we want to make it clear, this is, as far as I can remember, the only case in which
the dual controls of an Airbus have contributed to an incident.

(02:15:29):
This is slowly changing from a mechanical perspective.
Airbus is currently testing side sticks that have servo motors in them, and they are linked
to each other digitally, so whatever one stick does, the other one does.
This process is moving quite slowly, as you can imagine anything involving the stick that
makes the plane go up or down, left or right, is done very delicately and carefully.

(02:15:53):
One of the other things that's actually interesting about this is that it avoids the need for
a synthetic feel system that has been criticised on Airbuses as not actually giving as much
feel for the plane as it could have.
And as for Dubois's inability to put together when he arrived at the cockpit that they were
stalling and do something about it, it's most likely linked to him apparently having

(02:16:18):
only gotten an hour of sleep the night before, but that's impossible, we'll never know.
And the only way Dubois would have made any difference anyway is if he immediately kicked
the FOs out, grabbed the side stick, and performed a completely flawless stall recovery manoeuvre,
there's any hesitation and it would be too late, there wouldn't be enough altitude to
pull out.
The biggest single change from this crash was upset training.

(02:16:40):
And Fox, why don't you walk us through how training is different now?
So we call it enhanced envelope training or EET, and as a result of Air France 447 and
the aftermath, our sims now have full stall fidelity to replicate the full stall regime.
We do simulate entering the full stall regime and I'll tell you, it is equally part scary,

(02:17:02):
useful and fun as hell.
Not only do we practice full stalls at both high and low altitudes, but we also practice
recovery from inverted flight and other unusual attitudes and upset recoveries.
We do a lot more hand flying, especially in alternate and direct laws and even mechanical
backup and also turn off some of the automation and the flight director and hand fly raw data
arrivals and approaches.

(02:17:23):
We also get unreliable airspeed scenarios thrown at us by surprise and have to do what
we can to at least maintain level flight and a proper pitch and power for the applicable
phase of flight.
I'm not kissing ass when I say that I cannot praise EET enough.
My overall confidence as an Airbus pilot, my proficiency and the assurance in my ability
to react properly if I as a captain encountered an Air France 447 type situation has increased

(02:17:47):
significantly.
While EET has been a difficult and expensive investment for the airlines to make, it has
been a moral victory for the FAAA to enforce a sensible sea decision and not let the cost
complaints of the airlines suppress it.
Incidentally, when I was actually looking into this, it turns out that there is another
alternate control law that Airbus planes have, which we didn't mention earlier, which is

(02:18:10):
called abnormal attitude law, where I guess it's for when your plane is upside down, right?
Yeah, it gives you a little more leeway to bend the plane in the recovery.
But also Air France 447 never entered abnormal attitude law, so it didn't make any difference
here.

(02:18:30):
If I could just chime in on that, the purpose of abnormal attitude law is because if you're
in an upset recovery situation, you don't want the normal law protections preventing
you from rolling out of it.
I mean, the rule protection and possible style of stability, you don't want that.
You want to just be able to have direct authority to just roll out without anything stopping
you.
Yeah, very cool.

(02:18:50):
Okay, next slide.
Now, what did we learn from this?
This crash was complex, it was complicated, and as it turns out, there's a hell of a
lot more to the story than stupid pilot man holds stick back too much.
This crash was a microcosm of the analog and digital worlds kind of colliding, and it acted
as a massive wake up call for the industry for a very good reason.

(02:19:12):
These guys also ignored the stall warning pretty much all the way to impact in yet another
entry in Ares infinitely large and growing folder of accidents caused by people ignoring
a warning alarm.
In this case, as we discussed, it was maybe because they believed the bad airspeed data
was causing it, they couldn't square their behavior with the knowledge they were in a
stall, or maybe they just never heard it at all.
Push down the goddamn nose.

(02:19:33):
Just push, that's it.
That's the whole lesson.
Yeah, if the plane tells you you're stalling, you're probably stalling.
Again, push the nose down without hesitation and hold it.
Hashtag, believe stall warnings.
A couple of other observations from my experience, and this one goes out to Jay.
The complacency of Captain Dubois prior to the incident cannot be overlooked.

(02:19:54):
If I had been the captain, I would not have taken my fucking rest break during the transit
of the Intertropical Convergence Zone.
It would be like Captain Kirk or Captain Picard taking a nap while the USS Enterprise was
transiting the neutral zone with Klingon Romulan warships cloaked and ready to attack at any
moment.
Once they have to clear the storms and reach calmer air, then it would be a better time

(02:20:14):
to rack out and let the two FOs handle things.
I mean, you say that, but that's totally Kirk behavior.
Good to know.
He wasn't taking a nap, he was having sex.
I'll take your word for it.
Banging a blue lady.
Very possibly.
Another thing that cannot be understated is the importance of good crew resource management.

(02:20:37):
And you get a sense that the CRM between Bonnette and Robert started breaking down pretty rapidly
and it didn't get much better when Dubois ran out of the cockpit, which wasn't 100%
their fault because they were in a situation for which they were inadequately trained.
But in a more CRM-minded crew, and again today's EET reinforces this, the PM should have sprung
into action to gently coach the pilot, the PF, on maintaining basic aircraft control

(02:21:01):
through the storm and assist with some of the unique challenges of flying a manually
in alternate law without autofrust.
As in hypothetically coaching like this.
Okay, buddy, just keep the wings level, keep your pitch maybe three degrees nose up.
That's it.
All right, give me a minute to check the F-com for the proper manual thrust for the solitude.
Okay, 80% N1.

(02:21:23):
Just keep the thrust, it was right about there.
Okay, you're pitching up a bit too much.
Just get that nose back down on the horizon.
Bring it back to 350.
There you go.
And so on.
I mean, if nothing else, Rubeir staying cool and cold might have helped mitigate Bonin's
starter response and reactive control inputs.
That's really cool.
And I think that's a really good sort of real world example of how proper CRM is a soft

(02:21:46):
skill.
It's an art.
It's one that can't easily be described or taught in a classroom.
Kind of like aeronautical handling and not freaking out when you lose airspeed data.
All right, so any final thoughts before I close this out?
Yeah, I have one.
Go for it.
The Air France flight 447 changed aviation, but I want to emphasize it didn't do it alone.
During the period between about 2005 and 2014, there were a lot of high profile plane crashes

(02:22:10):
that happened due to pilots' inability to anticipate and recover from stalls, including
West Caribbean Airways flight 708, Colgan Air flight 3407, Air Algeria flight 5017, Indonesia
Air Asia flight 8501.
And that last one was an Airbus alternate law stall, eerily similar to Air France 447
that happened in 2014.

(02:22:32):
And maybe we'll cover it one day.
But all these accidents contributed to the urgency with which reforms happened.
And it's important to acknowledge that a lot more than 228 people died due to these issues
with the way that stalls were being taught.
And actually we can say now that it's made a huge difference because it has been a while
now since the last time there was a crash in this category anywhere in the world.

(02:22:54):
All right.
So that is a good success story to end on.
Next slide.
Let's go to.
All right.
Thanks everyone for joining us.
Our next episode will be on Malaysia Air 370.
I just want to say thanks to our guest, Fox.
Thank you very much.
Thank you everybody.
I appreciate you having me.
Bye.